nusatr Privacy Policy

This Privacy Policy ("Policy") describes how nusatr ("nusatr," "we," "us," or "our") collects, processes, stores, shares, and protects the personal data of users ("you," "Player," or "User") who access or use the nusatr online gaming platform available at nusatr.net and all associated mobile applications and digital services (collectively, the "Platform").

nusatr is committed to handling your personal information with transparency, integrity, and respect. We understand that Filipino players entrust us with sensitive personal and financial data, and we take that responsibility seriously. This Policy is designed to give you a clear, honest picture of our data practices — not to obscure them behind dense legal language.

By registering for a nusatr account, using the nusatr Login, depositing funds, or otherwise accessing any part of the Platform, you acknowledge that you have read, understood, and agreed to this Privacy Policy. This Policy forms part of nusatr's Terms and Conditions.

nusatr is an online casino and sports betting platform operated for the Philippine market, accessible at nusatr.net. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173), nusatr acts as the Personal Information Controller (PIC) — meaning we determine the purposes and means of processing your personal data.

nusatr operates within the regulatory framework established by the Philippine Amusement and Gaming Corporation (PAGCOR) for the protection of Filipino players. Our operations cover the entire Philippines, including Metro Manila, Cebu, Davao, Quezon City, Makati, and all other regions where online gaming is accessible.

Where nusatr engages third-party service providers to process personal data on our behalf (for example, payment processors such as GCash, Maya, BPI, BDO, and Metrobank), those parties act as Personal Information Processors (PIP) and are bound by data processing agreements that meet the requirements of RA 10173.

nusatr collects personal data that is necessary, adequate, and not excessive relative to the purposes for which it is collected. The categories of personal data we process are as follows:

nusatr collects personal data through the following means:

• Direct collection: Information you provide when registering for a nusatr account, completing KYC verification, making deposits or withdrawals via GCash, Maya, or Philippine bank transfers, contacting our support team, or responding to surveys and promotions.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, log files, and similar tracking technologies (see Section 7 for full details).
• Third-party sources: Identity verification data from KYC partners and government databases; fraud prevention signals from industry-shared fraud databases; payment data from GCash, Maya, BPI, BDO, Metrobank, QR Ph, GrabPay, and InstaPay; and marketing attribution data from advertising networks (where you have consented).
• Publicly available sources: In limited circumstances, nusatr may verify information using publicly available records consistent with applicable Philippine law.

We do not collect personal data from individuals who have not interacted with the Platform. We do not purchase third-party marketing lists or data brokers' consumer profiles for direct marketing purposes.

nusatr processes your personal data only for specified, explicit, and legitimate purposes. The following table sets out the legal bases under RA 10173 that we rely on for each processing activity:

• Account registration and maintenance — necessary for the performance of our contract with you as a nusatr player.
• Identity and age verification (KYC) — necessary for compliance with PAGCOR regulations and to fulfil our legal obligation to verify that all players are 21 years of age or older.
• Processing deposits and withdrawals — necessary for the performance of our contract with you; also required for AML compliance under the Anti-Money Laundering Act (AMLA).
• Customer support and dispute resolution — necessary for the performance of our contract and for our legitimate interests in maintaining service quality.
• Fraud detection and prevention — necessary for our legitimate interests in protecting nusatr and its players from fraud, money laundering, and cheating.
• Responsible gaming monitoring — necessary for compliance with PAGCOR's player protection framework and for our legitimate interest in preventing gambling-related harm to Filipino players.
• Platform analytics and improvement — based on our legitimate interests in understanding how the Platform is used and improving the experience for Filipino players across Metro Manila, Cebu, Davao, and beyond.
• Direct marketing communications — based solely on your explicit consent. You may withdraw consent at any time by updating your notification preferences within your account or by contacting support.
• Legal and regulatory compliance — necessary for compliance with applicable Philippine laws, PAGCOR directives, and court orders.

nusatr does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances, and always subject to binding confidentiality and data protection obligations:

• Payment processors: GCash, Maya (PayMaya), BPI, BDO, Metrobank, QR Ph, GrabPay, and InstaPay receive transaction-specific data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and Philippine BSP regulations.
• KYC and identity verification partners: We share identity documents and data with licensed KYC service providers to verify your age and identity as required by PAGCOR's player protection framework.
• Game and platform technology providers: Licensed game content providers receive limited technical data (session tokens, bet amounts) necessary to deliver game content and ensure RNG fairness audits.
• Fraud prevention networks: We may share fraud risk signals (device fingerprints, IP flags) with industry-standard fraud prevention services to protect the Platform and its players.
• Legal and regulatory authorities: nusatr will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine law enforcement agencies, or courts where required by law, court order, or valid regulatory directive.
• Business transfers: In the event of a merger, acquisition, or asset sale involving nusatr, personal data may be transferred as part of the transaction, subject to the incoming party maintaining equivalent data protection standards.

nusatr uses cookies and similar tracking technologies to operate the Platform, maintain your session, detect fraud, and — with your consent — improve your experience through analytics and personalised content.

The types of cookies used on nusatr are:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in during your nusatr session. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations. Disabling these may affect your experience.
• Analytics Cookies: Collect aggregated, anonymised data about how the Platform is used — pages visited, features accessed, session durations. Used to improve the Platform. Requires your consent.
• Security and Fraud Prevention Cookies: Help detect and prevent fraudulent activity, bot access, and account takeover attempts. These are necessary for the security of your account.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies may prevent you from accessing your nusatr account. Our cookie consent banner allows you to accept or decline non-essential cookies when you first visit the Platform.

nusatr retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. Our standard retention periods are as follows:

• Account and KYC data: Retained for the lifetime of your active nusatr account plus a minimum of five (5) years after account closure, as required by AMLA and PAGCOR record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction in compliance with the Anti-Money Laundering Act.
• Gaming and wagering history: Retained for three (3) years from the date of the gaming session for dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained for the duration of the marketing relationship plus one (1) year after consent is withdrawn, to demonstrate compliance.
• Technical and usage logs: Retained for up to twelve (12) months from collection, after which they are anonymised or deleted.

When retention periods expire, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

nusatr implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security programme includes:

• Encryption in transit: All data transmitted between your device and the nusatr Platform is encrypted using TLS 1.2 or higher. This includes all nusatr Login sessions, deposit flows, and API communications.
• Encryption at rest: Sensitive personal and financial data stored in nusatr's databases is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. All nusatr personnel with access to personal data are subject to background checks and confidentiality obligations.
• Two-Factor Authentication (2FA): nusatr offers SMS OTP-based 2FA for player accounts. We strongly recommend all Filipino players enable 2FA to protect their nusatr Login credentials.
• Penetration testing and vulnerability management: nusatr conducts regular security assessments and third-party penetration tests to identify and remediate vulnerabilities.
• Incident response: In the event of a personal data breach that poses a real risk to players' rights and freedoms, nusatr will notify the National Privacy Commission (NPC) within 72 hours and affected players as soon as practicable, in accordance with RA 10173's breach notification requirements.

As a data subject under the Data Privacy Act of 2012 (RA 10173), Filipino players have the following enforceable rights in relation to their personal data held by nusatr:

To exercise any of these rights, please contact nusatr's Data Protection Officer using the details provided in Section 14. We will verify your identity before processing any rights request to protect against fraudulent claims. There is no charge for exercising your rights in ordinary circumstances.

If you believe nusatr has not handled your personal data in accordance with RA 10173, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

The nusatr Platform is strictly intended for individuals who are 21 years of age or older, consistent with the minimum age for casino-style gambling under applicable Philippine regulations. nusatr does not knowingly collect, process, or retain personal data from individuals under 21 years of age.

During the registration process, nusatr requires all prospective players to confirm that they are at least 21 years old and to submit government-issued identification for age verification. Accepted documents include the Philippine National ID, passport, driver's licence, SSS/UMID card, and other PAGCOR-accepted identity documents.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling platforms. nusatr supports responsible internet use for Filipino families.

nusatr primarily stores and processes personal data within server infrastructure located in or accessible to the Philippines. However, some of our third-party service providers — such as cloud infrastructure providers, game content providers, and cybersecurity partners — may be located outside the Philippines.

Where personal data is transferred to countries outside the Philippines, nusatr ensures that such transfers are carried out in compliance with RA 10173 and the implementing rules of the National Privacy Commission. Safeguards we rely on include:

• Contractual clauses: We execute data processing agreements and standard contractual clauses with all third-party processors that receive personal data, requiring them to apply data protection standards equivalent to those required under Philippine law.
• Adequacy assessments: Before transferring data to a foreign jurisdiction, nusatr assesses whether that jurisdiction provides an adequate level of protection for personal data, consistent with NPC guidelines.
• Consent: In limited circumstances where no other transfer mechanism is available, we will seek your explicit consent prior to transferring your personal data outside the Philippines.

You may request information about the specific safeguards applicable to any international transfer of your personal data by contacting our Data Protection Officer at the details provided in Section 14.

nusatr reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, PAGCOR regulatory requirements, or the features and services offered on the Platform.

When material changes are made to this Policy, nusatr will notify you through one or more of the following channels:

• A prominent notice displayed on the nusatr homepage and Platform dashboard upon your next login.
• An email notification sent to the registered email address associated with your nusatr account.
• An in-platform notification requiring your acknowledgement before continued use.

The "Last Updated" date at the top of this document will always reflect the most recent revision. We encourage you to review this Privacy Policy periodically. Continued use of the nusatr Platform after the effective date of any amendment constitutes your acceptance of the updated Policy.

If you do not agree with the revised Privacy Policy, you should stop using the Platform and may request account closure by contacting our support team at [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or nusatr's data practices, you may contact our dedicated Data Protection Officer (DPO). Under RA 10173, nusatr has appointed a DPO to oversee compliance with the Data Privacy Act and to serve as your point of contact for all data privacy matters.

We aim to respond to all privacy-related requests and enquiries within fifteen (15) business days of receipt. For complex requests involving large volumes of data or multi-system searches, we may extend this period by a further fifteen (15) business days, in which case we will notify you of the extension and the reasons for it.

If you are not satisfied with nusatr's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent regulatory body responsible for enforcing RA 10173.