qa77 Privacy Policy

01 Who We Are

This Privacy Policy is issued by qa77 ("we," "us," "our," "the Platform"), the operator of the online gaming platform accessible at https://qa77.vu. qa77 operates under the supervision of the Philippine Amusement and Gaming Corporation (PAGCOR) and provides online gaming services — including slots, live casino, bingo, crash games, and coin games — to eligible players in the Philippines.

For the purposes of the Republic Act No. 10173 (Data Privacy Act of 2012), qa77 acts as the Personal Information Controller in respect of the personal data you provide when registering an account, using the Platform, or interacting with our support team.

This Policy applies to all personal data collected through the qa77 website, mobile application, Live Chat, email correspondence, and any other channel through which you interact with the Platform.

02 Data We Collect

qa77 collects personal data that falls into the following categories, depending on how you use the Platform:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (used for age verification — players must be 21 or older);
• Gender;
• Nationality and country of residence;
• Residential address (barangay, city/municipality, province, and ZIP code).

2.2 Contact Data

• Mobile number (primary contact and OTP delivery channel);
• Email address (account communications, transaction receipts, support).

2.3 Identity Verification (KYC) Documents

• Scanned or photographed copies of government-issued photo identification (e.g., PhilSys National ID, Philippine passport, driver's license, SSS/UMID card, PRC ID);
• Proof of address documents issued within the past three months (e.g., utility bill, bank statement, barangay certificate);
• Proof of payment method ownership where required (e.g., GCash screenshot showing registered name and mobile number).

2.4 Financial & Transaction Data

• Deposit and withdrawal amounts, dates, and payment method references;
• GCash or PayMaya account reference numbers (not full credentials);
• Bank account details where bank transfer is the selected payment method (BPI, BDO, Metrobank);
• Transaction history and account balance records.

2.5 Gaming & Behavioural Data

• Game session records, wager amounts, game outcomes, and win/loss data;
• Platform navigation patterns, feature usage, and session duration;
• Responsible gaming tool usage (deposit limits set, self-exclusion requests).

2.6 Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type and version;
• Unique device identifiers where applicable;
• Log data including login timestamps, pages accessed, and error logs.

2.7 Communications Data

• Records of Live Chat conversations, emails, and support ticket exchanges;
• Feedback and survey responses submitted voluntarily.

03 How We Collect Your Data

qa77 collects your personal data through the following channels and mechanisms:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact our support team, or respond to a survey;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies as you navigate and interact with the Platform;
• From third-party service providers — including payment processors (GCash, PayMaya, BPI, BDO, Metrobank) who confirm transaction status, and identity verification partners who assist with KYC compliance;
• From regulatory and law-enforcement sources — where qa77 is required by PAGCOR directives, AMLC requirements, or a lawful order to verify or supplement information about an account holder.

04 Why We Use Your Data

qa77 uses the personal data we collect for the following specific, legitimate purposes:

• Account creation and management — to register your account, authenticate your identity on login, and manage your account settings and preferences;
• Age and identity verification — to confirm that you meet the 21+ age requirement under Philippine law and PAGCOR regulations, and to verify your identity as required by our KYC obligations;
• Payment processing — to facilitate deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank, and to maintain accurate transaction records in Philippine Peso (PHP);
• Regulatory compliance — to comply with PAGCOR licensing requirements, the Anti-Money Laundering Act (Republic Act No. 9160), and other applicable Philippine legislation, including transaction monitoring and suspicious activity reporting;
• Platform delivery and improvement — to provide and maintain gaming services, diagnose technical issues, analyse usage patterns, and develop new features and enhancements;
• Responsible gaming — to implement and monitor responsible gaming tools (deposit limits, self-exclusion, session reminders), and to identify players who may be showing signs of problem gambling behaviour;
• Customer support — to respond to your queries, complaints, and support requests, and to maintain records of our communications with you;
• Security and fraud prevention — to detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and other prohibited conduct;
• Marketing communications — with your consent, to send you information about qa77 promotions, bonuses, and new features via email or SMS. You may withdraw consent at any time by using the unsubscribe mechanism in any marketing communication or by contacting support.

05 Legal Bases for Processing

Under the Data Privacy Act of 2012 and its implementing rules, qa77 relies on the following legal bases for processing your personal data:

• Contractual necessity — processing required to enter into and perform the agreement between you and qa77 (i.e., account registration, payment processing, game delivery);
• Legal obligation — processing required to comply with applicable Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act, and the Data Privacy Act itself;
• Legitimate interests — processing carried out for purposes that are in qa77's legitimate business interests and are proportionate, including fraud prevention, security monitoring, platform analytics, and responsible gaming monitoring — provided such interests do not override your rights and freedoms;
• Consent — processing for optional purposes such as marketing communications, where your prior consent has been obtained. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

06 Sharing Your Data

qa77 does not sell your personal data. We share personal data only in the circumstances described below, and only to the minimum extent necessary for each purpose:

6.1 Service Providers

qa77 engages third-party service providers to support its operations, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification partners, game software suppliers, cloud hosting providers, and customer support platform operators. These providers act as personal information processors on qa77's behalf and are contractually bound to process data only on our documented instructions, to implement appropriate security measures, and to comply with the Data Privacy Act.

6.2 Regulatory and Law Enforcement Authorities

qa77 is required by Philippine law to share information with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities in certain circumstances — for example, when responding to a lawful request for information, a court order, or when reporting suspicious transactions under the Anti-Money Laundering Act. Such disclosures are made without prior notice to the account holder where legally required.

6.3 Business Transfers

In the event that qa77 undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this Policy. You will be notified of any such transfer through an update to this Privacy Policy.

6.4 With Your Consent

qa77 may share your data with third parties in other circumstances where you have given your explicit prior consent. You may withdraw such consent at any time by contacting our support team.

07 Cookies & Tracking Technologies

qa77 uses cookies and similar tracking technologies on its website and mobile application to deliver, operate, and improve the Platform. The following types of cookies may be set on your device:

• Strictly necessary cookies — required for the Platform to function. These include session authentication cookies, security tokens, and language preference settings. These cannot be disabled without impairing Platform functionality;
• Functional cookies — used to remember your preferences (e.g., preferred payment method display, responsible gaming settings) and to provide a more personalised experience;
• Analytics cookies — used to collect aggregated, anonymised information about how players use the Platform, which pages are visited most frequently, and where errors occur. This data is used to improve Platform performance and user experience;
• Security cookies — used to detect and prevent fraudulent activity, including bot activity and account takeover attempts.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect Platform functionality. qa77 does not use third-party advertising or cross-site tracking cookies.

08 Data Retention

qa77 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods required by applicable Philippine law and regulation. The following retention guidelines apply:

• Account and identity data — retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• KYC documents — retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later;
• Transaction records — retained for a minimum of five (5) years from the date of each transaction, in compliance with anti-money laundering record-keeping requirements;
• Communications records — Live Chat transcripts and email records are retained for two (2) years from the date of the most recent communication in each thread;
• Marketing consent records — retained for the duration of your consent and for one (1) year following its withdrawal, as evidence of consent management;
• Technical and log data — retained for ninety (90) days, unless required to be retained longer in connection with a security incident or legal investigation.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with qa77's data disposal procedures. Anonymised, aggregated data may be retained indefinitely for statistical analysis purposes.

09 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you hold the following rights in respect of your personal data processed by qa77. To exercise any of these rights, contact us at [email protected] with the subject line "Data Subject Request."

qa77 will respond to all data subject requests within thirty (30) calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for it.

Identity verification will be required before any data subject request is processed to ensure that we do not disclose, amend, or delete another person's data in error.

10 Children & Minors

The qa77 Platform is strictly for persons aged 21 years and above, as required by Philippine law and PAGCOR regulations. qa77 does not knowingly collect personal data from persons under 21 years of age.

If qa77 discovers or is notified that personal data has been collected from a person under 21, the relevant account will be immediately suspended, all data associated with that account will be reviewed, and the data will be securely deleted to the extent not required to be retained for legal or regulatory compliance purposes.

If you believe that qa77 may have inadvertently collected data from a minor, please notify us immediately at [email protected].

11 International Data Transfers

qa77's primary operations and data processing activities are based in the Philippines. In some cases, personal data may be transferred to, stored, or processed in other countries — for example, where a game software supplier or cloud infrastructure provider operates servers outside the Philippines.

Where such international transfers occur, qa77 ensures that adequate safeguards are in place to protect your personal data, including:

• Contractual clauses that impose data protection obligations equivalent to those required by the Philippine Data Privacy Act;
• Transfers only to countries or organisations that the National Privacy Commission has recognised as providing an adequate level of data protection;
• Binding corporate rules where transfers occur within a group of related entities.

You may request details of the safeguards applied to any specific international transfer by contacting us at [email protected].

12 Security Measures

qa77 implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and qa77 servers is encrypted using 256-bit SSL/TLS protocols;
• Encryption at rest: Sensitive personal data stored on qa77 servers is encrypted at rest using industry-standard encryption algorithms;
• Access controls: Strict role-based access controls limit internal access to personal data to authorised personnel with a documented operational need. All access is logged;
• Two-factor authentication: Two-factor authentication (2FA) is available to all players and is required for certain high-risk account actions;
• Penetration testing: qa77's systems undergo regular independent security assessments and penetration testing;
• Staff training: All qa77 staff with access to personal data receive data privacy and information security training;
• Incident response: qa77 maintains a documented data breach incident response plan with defined notification timelines consistent with the Data Privacy Act.

While qa77 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You play an important role in keeping your account safe by maintaining a strong, unique password, enabling 2FA, and notifying us immediately of any suspected unauthorised access.

13 Changes to This Privacy Policy

qa77 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, we will notify you through one or more of the following methods:

• A notice displayed on the Platform upon your next login;
• An email notification to your registered email address;
• Publication of the updated Policy on this page with a revised "Last Updated" date at the top.

Your continued use of the qa77 Platform after a revised Privacy Policy has been published constitutes your acknowledgement of the changes. If the changes involve a new processing purpose that requires your consent, we will seek that consent separately before processing begins.

We recommend reviewing this page periodically, particularly after receiving any notification of an update.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or qa77's data practices, or if you wish to exercise any of your rights as a data subject, you may contact us through the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request" as applicable;
• Live Chat: Available 24 hours a day, 7 days a week via the qa77 website and mobile app;
• Response time: We aim to acknowledge all privacy-related enquiries within 24 hours and provide a substantive response within 30 calendar days.

If you are not satisfied with qa77's response to your privacy enquiry or data subject request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.