felbit Privacy Policy — Your Data, Protected

1.1 This Policy applies to all personal data collected and processed by felbit in connection with the provision of its online gaming, sports betting, promotions, customer support, and payment processing services. It covers data collected through the felbit website, mobile-optimized platform, live chat system, and any other digital channel operated by felbit.

1.2 This Policy is published in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. Where PAGCOR's regulatory requirements impose additional data obligations, those requirements are also incorporated into felbit's data handling practices.

1.3 By registering an account on felbit, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue use of the felbit platform.

1.4 This Policy should be read together with felbit's Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your use of the felbit platform.

2.1 For the purposes of the Data Privacy Act of 2012 and this Policy, felbit is the Personal Information Controller (PIC) responsible for the personal data of all registered players and platform visitors.

2.2 felbit operates as a PAGCOR-regulated online gaming platform under Philippine law. As the Personal Information Controller, felbit determines the purposes and means of processing your personal data and is accountable for ensuring that processing is conducted lawfully, fairly, and transparently.

2.3 felbit has appointed a Data Protection Officer (DPO) who is responsible for overseeing data protection strategy and implementation, ensuring compliance with the Data Privacy Act, serving as the primary point of contact for all data privacy inquiries, and liaising with the National Privacy Commission when required. Contact details for the felbit DPO are provided in Section 15 of this Policy.

3.1 felbit collects personal data that is necessary, adequate, and not excessive for the purposes described in this Policy. The categories of personal data we collect include:

3.2 Sensitive Personal Information. Certain data elements — such as government-issued ID numbers and financial account details — are classified as sensitive personal information under the Data Privacy Act of 2012. felbit processes these categories only where strictly required for KYC/AML compliance, PAGCOR regulatory obligations, or fraud prevention, and applies enhanced security measures to their storage and processing.

4.1 Directly from You. The majority of personal data felbit holds is provided directly by you during:

• Account registration — when you provide your name, date of birth, contact details, and create your login credentials;
• KYC verification — when you submit government-issued identification and proof of address documents;
• Payment transactions — when you link a GCash, Maya, bank account, or other payment method to your felbit account;
• Customer support interactions — when you contact our team via live chat or email;
• Promotional participation — when you opt in to bonus offers, tournaments, or marketing communications;
• Responsible gaming requests — when you set deposit limits, request cooling-off periods, or apply for self-exclusion.

4.2 Automatically. When you access and use the felbit platform, we automatically collect certain technical and behavioral data through:

• Server logs that record IP addresses, access times, pages visited, and actions taken;
• Cookies and similar tracking technologies (see Section 11 for full details);
• Game servers that record all bets, outcomes, and session data in real time;
• Security and fraud detection systems that monitor login patterns and transaction behavior.

4.3 From Third Parties. In limited circumstances, felbit may receive personal data about you from third parties, including:

• Identity verification service providers engaged to perform document authentication and facial recognition checks;
• Payment processors who provide transaction confirmation and account ownership data;
• PAGCOR and law enforcement agencies pursuant to regulatory obligations;
• Publicly available sources such as sanctions lists and politically exposed persons (PEP) databases.

5.1 felbit processes your personal data only for specific, legitimate purposes. The primary purposes for which we use your data are as follows:

• Account creation and management: To register your account, authenticate your identity at login, and maintain accurate account records;
• KYC and AML compliance: To verify your identity, age, and source of funds as required by PAGCOR regulations and the Anti-Money Laundering Act (Republic Act No. 9160, as amended);
• Payment processing: To process deposits and withdrawals through GCash, Maya, and other accepted payment channels securely and accurately;
• Game delivery: To provide access to felbit's full catalogue of casino games, bingo, slots, dice, Dragon Hatch, and sports betting markets;
• Responsible gaming: To monitor gaming behavior, enforce player-requested limits, identify at-risk players, and implement self-exclusion requests;
• Fraud and security: To detect unauthorized access, money laundering, bonus abuse, and other prohibited activities on the platform;
• Customer support: To respond to your inquiries, resolve disputes, and deliver quality service in both English and Tagalog;
• Legal and regulatory compliance: To meet our obligations under Philippine law, respond to lawful requests from PAGCOR, the AMLC, and the NPC, and defend against legal claims;
• Marketing communications: To send you information about promotions, new games, and platform updates — but only where you have given your explicit consent, which you may withdraw at any time.

5.2 felbit will not use your personal data for any purpose materially different from those listed above without first obtaining your consent or establishing a separate legitimate legal basis for doing so.

6.1 Under the Data Privacy Act of 2012, felbit relies on the following legal bases for processing your personal data:

• Consent: Where you have freely given, specific, informed, and unambiguous consent to the processing of your personal data — primarily for marketing communications and optional profiling features;
• Contractual necessity: Where processing is necessary for the performance of our contract with you (i.e., the Terms & Conditions) — including account management, game delivery, and payment processing;
• Legal obligation: Where processing is required to comply with Philippine laws and regulations, including the Data Privacy Act, Anti-Money Laundering Act, PAGCOR regulations, and National Privacy Commission directives;
• Legitimate interests: Where processing is necessary for felbit's legitimate interests in operating a secure, fair, and sustainable gaming platform — including fraud detection, platform security, and service improvement — provided that such interests are not overridden by your fundamental rights and freedoms.

6.2 Where felbit relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without prejudice to processing that has already taken place on the basis of consent before its withdrawal. To withdraw consent for marketing communications, use the unsubscribe link in any marketing email or contact our support team via live chat.

7.1 felbit shares your personal data only in the following limited and necessary circumstances:

• Game providers: Licensed third-party game studios and live dealer providers receive the minimum data necessary to authenticate your game session and record outcomes for integrity purposes. These providers are bound by strict data processing agreements;
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment partners receive your payment account details and transaction data solely for the purpose of executing your deposits and withdrawals;
• Identity verification providers: Third-party KYC service providers receive your identification documents and biometric data solely for the purpose of completing your identity verification;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government agencies receive data where legally required or upon lawful request;
• Law enforcement: Philippine law enforcement agencies may receive data pursuant to a lawful court order, warrant, or mandatory disclosure obligation;
• Responsible gaming organizations: Where a player has self-excluded, their exclusion status may be shared with PAGCOR's responsible gaming registry to prevent re-registration on other regulated platforms;
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by felbit may access personal data on a need-to-know basis under strict confidentiality obligations.

7.2 All third parties to whom felbit discloses personal data are required to process that data strictly in accordance with felbit's instructions, applicable Philippine law, and their own contractual data protection obligations. felbit conducts due diligence on all data processors before engagement and reviews these arrangements periodically.

8.1 felbit retains personal data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law and regulation. The following retention periods apply:

8.2 Upon expiry of the applicable retention period, felbit will securely delete or anonymize personal data in a manner that makes re-identification impossible, unless an ongoing legal obligation requires continued retention.

8. 3 Where felbit is involved in ongoing legal proceedings, regulatory investigations, or unresolved disputes, relevant personal data will be retained until those matters are fully concluded, regardless of the standard retention period that would otherwise apply.

9.1 felbit implements a comprehensive, multi-layered information security programme to protect your personal data against unauthorized access, accidental loss, destruction, alteration, and unlawful disclosure. Our technical and organizational security measures include:

• Encryption: AES-256 encryption for data at rest and TLS 1.3 for all data in transit between your device and felbit servers;
• Access controls: Role-based access control (RBAC) ensures that only authorized felbit personnel with a legitimate need can access personal data, and all access is logged and audited;
• Multi-factor authentication: felbit staff accessing internal systems with personal data are required to use multi-factor authentication on all access points;
• Network security: Firewalls, intrusion detection systems, and Web Application Firewalls (WAF) protect the felbit platform from external threats;
• Penetration testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities;
• Secure development: felbit follows secure software development lifecycle (SSDLC) practices, including code reviews and security testing before any new feature is deployed to the live platform;
• Staff training: All felbit personnel with access to personal data receive mandatory data privacy and information security training at onboarding and annually thereafter.

9.2 While felbit takes all reasonable steps to protect your data, no information security system is completely impenetrable. You are responsible for maintaining the confidentiality of your own felbit account credentials and for ensuring that you log out after each session, particularly when accessing the platform from a shared or public device.

10.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by felbit. felbit is committed to facilitating the exercise of these rights in a timely, straightforward manner:

10.2 To exercise any of the rights listed above, contact felbit's Data Protection Officer via live chat or at the email address provided in Section 15. felbit will respond to all verifiable data subject requests within fifteen (15) business days. Where a request is complex or involves large volumes of data, we may extend this period by an additional fifteen (15) business days, with prior notice to you.

10.3 felbit may request proof of identity before processing a data subject request to ensure that personal data is not disclosed to unauthorized parties. This verification step is a protective measure for your benefit.

11.1 felbit uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your session security, and analyze platform performance. The categories of cookies used on felbit are as follows:

11.2 When you first visit the felbit platform, you will be presented with a cookie consent banner that allows you to accept all cookies, accept only necessary cookies, or customize your preferences. You may update your cookie settings at any time through the Cookie Preferences link in the platform footer.

11.3 felbit does not use third-party advertising cookies or behavioral advertising trackers. We do not allow advertising networks to set cookies on the felbit platform for the purpose of building audience profiles for cross-site advertising.

12.1 felbit strictly prohibits the registration and participation of persons under the age of 21 years on the platform, in full compliance with Philippine gaming law and PAGCOR regulations governing the minimum age for participation in online casino and sports betting activities.

12.2 As part of the KYC verification process, felbit requires all players to submit a valid government-issued identification document confirming their age before any deposits, wagers, or withdrawals are permitted. Accounts where age verification cannot be completed will be suspended pending document submission.

12.3 If felbit becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the account, refund any deposited funds (subject to verification that no bonus funds were misused), delete the personal data, and report the incident to PAGCOR as required.

12.4 Parents and guardians who believe a minor has registered on the felbit platform are encouraged to contact our support team immediately via live chat so that the account can be reviewed and actioned without delay.

13.1 felbit's primary data processing infrastructure is located within Philippine-jurisdiction data centers. However, certain service providers engaged by felbit — including international game studios and identity verification platforms — may be located in, or process data in, jurisdictions outside the Philippines.

13.2 Where personal data is transferred outside the Philippines, felbit ensures that such transfers are protected by appropriate safeguards, including:

• Standard contractual clauses approved by the National Privacy Commission or equivalent data protection authority of the receiving country;
• Adequacy determinations confirming that the receiving country provides a level of data protection equivalent to that of the Philippines;
• Binding corporate rules where data is transferred to entities within the same corporate group as a felbit service provider;
• Explicit consent from the data subject where the above safeguards are not available and the transfer is in the data subject's vital interest.

13.3 felbit maintains a register of all cross-border data transfers and the safeguards applied to each. This information is available to the National Privacy Commission upon request. Players who wish to obtain more information about specific cross-border transfers affecting their personal data may contact the felbit DPO as described in Section 15.

14.1 felbit reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC regulations, or PAGCOR requirements. The effective date at the top of this Policy will always reflect the date on which the most current version took effect.

14.2 Where changes to this Policy are material — meaning they substantially affect your rights as a data subject or significantly alter how we use your personal data — felbit will notify registered players via the email address associated with their account at least seven (7) calendar days before the changes take effect.

14.3 For non-material changes, such as clarifications, corrections to typographical errors, or updates required by minor regulatory amendments, the revised Policy will take effect upon publication on the felbit platform. We encourage you to review this Policy periodically to stay informed of how felbit protects your personal data.

14.4 Continued use of the felbit platform after the effective date of any amendment to this Privacy Policy constitutes your acknowledgment of and agreement to the amended Policy.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by felbit, please contact us through any of the following channels:

• Live Chat: Available 24/7 on the felbit platform — the fastest way to reach our support and privacy teams;
• Email: [email protected] (plain text — not a clickable link);
• For Data Privacy Requests specifically: Use the subject line "Data Privacy Request — [Your Request Type]" when emailing the DPO;
• Language: Support and DPO communications are available in both English and Tagalog.

15.2 felbit's Data Protection Officer is responsible for ensuring the Company's compliance with the Data Privacy Act of 2012 and all applicable NPC regulations. The DPO will acknowledge receipt of your data privacy request within three (3) business days and provide a substantive response within fifteen (15) business days.

15.3 If you believe felbit has not adequately addressed your data privacy concern after following our internal process, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which is the competent supervisory authority for data protection matters in the Philippines.