Privacy Policy — sweet99

1. Introduction

sweet99 ("we", "us", "our", or "sweet99") is committed to protecting and respecting the privacy of every individual who uses our online gaming platform at sweet99.app (the "Platform"). This Privacy Policy has been prepared to comply with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the applicable issuances of the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected by sweet99 through your use of the Platform, including during account registration, identity verification, gameplay, financial transactions, customer support interactions, and promotional activities. It also covers data collected through cookies, analytics tools, and other automated technologies deployed on the Platform.

sweet99 operates as a personal information controller (PIC) as defined under RA 10173. We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with applicable data privacy laws. Contact details for the DPO are provided in Section 14 of this Policy.

This Privacy Policy should be read together with sweet99's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Personal Data We Collect

sweet99 collects the following categories of personal data from users of the Platform:

2.1 Identity and Registration Data

• Full legal name (as appearing on a government-issued ID);
• Date of birth (used for age verification — players must be 21 years or older);
• Gender;
• Nationality and country of residence;
• Government-issued identification number (e.g., PhilSys ID number, SSS, UMID, passport number, or driver's licence number);
• Profile photograph (where submitted as part of KYC).

2.2 Contact Data

• Email address;
• Mobile phone number;
• Residential address (street, city/municipality, province, ZIP code).

2.3 Financial and Transaction Data

• GCash account number or registered mobile number;
• PayMaya / Maya wallet details;
• Bank account details (BPI, BDO, Metrobank) where used for deposits or withdrawals;
• Deposit and withdrawal transaction history;
• Source of funds information (where required by AML regulations);
• Account balance and transaction timestamps.

2.4 Gaming and Behavioural Data

• Game session records (game title, duration, stakes, outcomes);
• Betting history and wagering patterns;
• Bonus and promotion usage records;
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion records).

2.5 Technical and Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser version;
• Device identifier (where applicable);
• Session logs and access timestamps;
• Cookie identifiers and similar tracking data (see Section 7).

2.6 Communications Data

• Records of customer support interactions (live chat transcripts, email correspondence);
• Feedback and survey responses;
• Marketing communication preferences.

3. How We Collect Your Personal Data

sweet99 collects your personal data through the following means:

• Directly from you — when you register an account, complete identity verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or respond to a survey;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you browse or interact with the Platform (see Section 7);
• From third-party KYC and identity verification providers — who verify the authenticity of documents you submit during the Know Your Customer (KYC) process;
• From payment processors — such as GCash, PayMaya, and Philippine banking institutions, when you initiate a deposit or withdrawal transaction;
• From fraud prevention and AML screening services — where sweet99 is required to screen users against regulatory watchlists as part of its PAGCOR compliance obligations.

4. How We Use Your Personal Data

sweet99 uses your personal data for the following purposes:

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, sweet99 processes your personal data on the following lawful bases:

• Contractual necessity — processing required to fulfil our contractual obligations to you under the sweet99 Terms & Conditions (e.g., account management, payment processing, gameplay);
• Legal obligation — processing required to comply with applicable Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act, and the Data Privacy Act itself (e.g., KYC verification, AML transaction monitoring, regulatory reporting);
• Legitimate interests — processing necessary for sweet99's legitimate business interests, where those interests are not overridden by your data protection rights (e.g., fraud prevention, platform security, responsible gaming monitoring);
• Consent — where you have given explicit, informed, and freely given consent for a specific processing activity (e.g., receiving marketing communications). You may withdraw your consent at any time by contacting sweet99 support or updating your account preferences.

6. Data Sharing and Disclosure

sweet99 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

6.1 Service Providers and Data Processors

sweet99 engages trusted third-party service providers to assist in operating the Platform, including:

• KYC and identity verification service providers;
• Payment processors (GCash / GXI, PayMaya / Voyager, BPI, BDO, Metrobank, and Instapay-connected institutions);
• Cloud hosting and server infrastructure providers;
• Customer support platform providers;
• Analytics and fraud detection service providers.

All third-party data processors engaged by sweet99 are bound by contractual data processing agreements requiring them to maintain appropriate security measures and process your data only for the specified purpose and in accordance with our instructions.

6.2 Regulatory and Law Enforcement Authorities

sweet99 may disclose your personal data to Philippine government authorities, including but not limited to:

• PAGCOR — the Philippine Amusement and Gaming Corporation, as sweet99's regulatory body;
• AMLC — the Anti-Money Laundering Council of the Philippines, as required by RA 9160;
• NPC — the National Privacy Commission, in the event of a reportable data breach or regulatory inquiry;
• Philippine law enforcement agencies, courts, or other government bodies, where required by valid legal process (e.g., court order, subpoena, or lawful request).

sweet99 will make reasonable efforts to notify you of such disclosure where legally permitted to do so.

6.3 Corporate Transactions

In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of sweet99's assets, your personal data may be transferred to the successor entity, subject to that entity providing equivalent or greater data protection standards. You will be notified of any such transfer in accordance with applicable law.

7. Cookies and Tracking Technologies

sweet99 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device when you visit the Platform. They enable sweet99 to recognize your browser, maintain your session, and provide a personalized and secure gaming experience.

7.1 Types of Cookies Used

7.2 Managing Cookies

You may control non-essential cookies through your browser settings or through the cookie preference centre available on the Platform. Please note that disabling strictly necessary cookies may impair your ability to log in and use core Platform features. Detailed browser-level cookie management instructions are available from your browser provider's help documentation.

8. Data Security

sweet99 implements a comprehensive, layered approach to data security, including the following technical and organizational measures:

• Encryption in transit: All data transmitted between your device and sweet99's servers is encrypted using Transport Layer Security (TLS 1.2 or higher);
• Encryption at rest: Sensitive personal data stored on sweet99's servers, including KYC documents and financial records, is encrypted using AES-256 or equivalent industry-standard encryption;
• Access controls: Access to personal data is restricted to authorized sweet99 personnel and third-party processors on a strict need-to-know basis, using role-based access controls and multi-factor authentication;
• Security monitoring: sweet99 maintains 24/7 security monitoring and intrusion detection systems to identify and respond to potential threats;
• Regular security assessments: sweet99 conducts periodic penetration testing, vulnerability assessments, and security audits of its Platform and data infrastructure;
• Incident response: sweet99 maintains a formal data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, sweet99 will notify the NPC within 72 hours of discovery, and affected users as required by RA 10173.

Despite these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. sweet99 cannot guarantee the absolute security of your personal data and encourages you to take appropriate steps to protect your own account credentials as described in our Terms & Conditions.

9. Data Retention

sweet99 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable Philippine law.

The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR regulatory requirements and the Anti-Money Laundering Act;
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction, as required by AML regulations;
• KYC verification documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant KYC process;
• Customer support records: Retained for three (3) years from the date of the interaction;
• Marketing preference data: Retained until you withdraw consent or for a maximum of three (3) years from your last interaction with sweet99's marketing communications, whichever is sooner;
• Cookie and analytics data: Retained in accordance with the durations specified in Section 7.

Upon expiry of the applicable retention period, sweet99 will securely delete or anonymise your personal data in a manner that prevents recovery. Where deletion is not immediately practicable for technical reasons, sweet99 will ensure the data is isolated and protected from further processing until deletion is completed.

10. Your Data Subject Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by sweet99:

• Right to Access (Section 16, RA 10173): You have the right to request confirmation of whether sweet99 holds personal data about you, and to receive a copy of that data in a commonly used format;
• Right to Rectification: You have the right to request correction of any inaccurate, incomplete, or outdated personal data held by sweet99. You may update certain account details directly through your account settings;
• Right to Erasure or Blocking: You have the right to request deletion or blocking of your personal data where it is no longer necessary for the purpose for which it was collected, or where processing is unlawful — subject to sweet99's legal retention obligations;
• Right to Object: You have the right to object to the processing of your personal data based on legitimate interests, including processing for direct marketing purposes. Objection to marketing can be exercised by updating your account preferences or contacting support;
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that sweet99 transmit that data to another personal information controller where technically feasible;
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe sweet99 has processed your personal data in violation of RA 10173. The NPC can be contacted at privacy.gov.ph.

To exercise any of the above rights, please contact sweet99's Data Protection Officer as described in Section 14. sweet99 will respond to all verified data subject requests within fifteen (15) calendar days of receipt, or within such extended period as may be permitted by applicable law.

11. Minors and Age Restriction

The sweet99 Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gambling regulations and PAGCOR requirements. sweet99 does not knowingly collect personal data from persons under the age of 21.

If sweet99 discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age, sweet99 will:

• Immediately suspend the associated account;
• Delete all personal data collected from or relating to the underage individual as soon as practicable;
• Forfeit and void any account balance, bonuses, or winnings in the account, consistent with the sweet99 Terms & Conditions;
• Where required by law, report the incident to relevant authorities.

If you are a parent or guardian and have reason to believe that a minor in your care has registered on the sweet99 Platform, please contact sweet99 support immediately at the details in Section 14 so that the account can be investigated and closed without delay.

12. Third-Party Services and Links

The sweet99 Platform may contain references to or integrations with third-party service providers necessary for platform operation, such as payment processors and KYC verification providers. sweet99 is not responsible for the privacy practices of any third-party service provider beyond what is governed by our data processing agreements with them.

Where sweet99 engages a third-party data processor, we ensure that:

• A written data processing agreement is in place that obligates the processor to implement appropriate technical and organizational security measures;
• The processor is permitted to use your personal data only for the specific, documented purpose for which they were engaged by sweet99;
• The processor does not engage further sub-processors without sweet99's prior written authorization;
• The processor cooperates with sweet99 and the NPC in the event of a data breach or regulatory inquiry.

sweet99 does not embed third-party advertising networks or social media tracking pixels that would share your personal data with unrelated third-party advertisers without your explicit consent. All integrations on the Platform are strictly operational in nature and directly related to delivering our licensed gaming services.

12.1 Cross-Border Data Transfers

In certain cases, sweet99's third-party service providers may process your personal data outside the Philippines. Where such cross-border transfers occur, sweet99 ensures that adequate safeguards are in place, including contractual clauses requiring the recipient to uphold data protection standards consistent with RA 10173. sweet99 will not transfer your personal data to a foreign jurisdiction that does not provide a comparable level of data protection without your explicit prior consent, except where required to do so by Philippine law.

13. Amendments to This Privacy Policy

sweet99 reserves the right to update, revise, or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. Any amendments will be effective upon publication of the updated Privacy Policy on the Platform.

Where a proposed amendment materially affects your rights or the way in which sweet99 processes your personal data, sweet99 will provide advance notice of the change by:

• Posting a prominent notice on the Platform at least fifteen (15) days prior to the effective date of the change; and/or
• Sending a notification to the email address registered on your sweet99 account.

Your continued use of the sweet99 Platform following the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. If you do not agree to the amended terms, you must discontinue your use of the Platform and may request account closure by contacting sweet99 support.

sweet99 recommends that you review this Privacy Policy periodically to stay informed of how we protect your personal data. The "Effective Date" at the top of this document reflects the date of the most recent revision.

14. Contact Our Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or sweet99's handling of your personal data, you may contact our designated Data Protection Officer (DPO) using the details below:

For complaints that remain unresolved after contacting our DPO, you have the right to escalate your concern to the National Privacy Commission of the Philippines at privacy.gov.ph. sweet99 will cooperate fully with any NPC investigation or mediation process.

All data subject requests must be submitted in writing (by email) and must include sufficient information for sweet99 to verify your identity before processing the request. This verification step is necessary to protect your personal data from unauthorized disclosure or modification.