1 Introduction
1.1 866gl is a Philippine-focused online casino and sports betting platform regulated by the Philippine Amusement and Gaming Corporation (PAGCOR). In the course of operating the Platform, we collect and process personal data about our registered users and, in certain circumstances, visitors to the Platform who have not yet registered.
1.2 We are committed to handling your personal data with care, transparency, and in strict compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and the regulations and advisories issued by the National Privacy Commission ("NPC").
1.3 This Policy describes what data we collect, why we collect it, how we use and protect it, how long we keep it, who we share it with, and what rights you have in relation to it. We have written this Policy in plain language because we want every Filipino user — whether in Manila, Cebu, Davao, or anywhere in the provinces — to genuinely understand how their personal information is handled on 866gl.
2 Data Controller
2.1 For the purposes of the DPA and this Policy, the data controller for personal data collected through the 866gl Platform is 866gl, the operator of https://866gl.app, operating under a license issued by PAGCOR.
2.2 866gl has appointed a Data Protection Officer ("DPO") who oversees compliance with this Policy and applicable data privacy regulations. The DPO is the primary point of contact for all privacy-related inquiries and requests. Contact details for the DPO are set out in Section 16 of this Policy.
2.3 866gl is registered with the National Privacy Commission as a personal information controller as required by the DPA.
3 Personal Data We Collect
3.1 We collect personal data from you in the following ways: (a) directly from you when you register, verify your identity, make transactions, or contact support; (b) automatically when you use the Platform; and (c) from authorised third-party sources such as identity verification providers and payment processors.
3.2 The categories of personal data we collect and process are described in the table below:
| Category | Data Elements | Collection Method |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, government-issued ID number and copies, selfie photograph | Registration form; KYC verification |
| Contact Data | Philippine mobile number, email address (if provided) | Registration form; account settings |
| Account Data | Username, hashed password, account balance, transaction history, bet history, game session records | Automatically generated on registration; Platform activity |
| Financial Data | GCash account name / number (last digits only), Maya account details (last digits only), transaction reference numbers, deposit and withdrawal amounts | Payment processing; KYC verification |
| Technical Data | IP address, device type, operating system, browser type, mobile network identifier, session cookies, login timestamps | Automatically via Platform access |
| Usage Data | Pages visited, games played, betting patterns, session duration, in-game actions, feature usage | Automatically via Platform activity tracking |
| Communications Data | Customer support chat logs, email correspondence, complaint records | Direct communication with 866gl |
| Marketing Preferences | Opted-in SMS/email marketing consent status and preferences | Registration form; account settings |
3.3 Sensitive Personal Information. Under the DPA, certain data elements — including government-issued ID numbers and copies — constitute sensitive personal information. 866gl processes such data only where strictly necessary for KYC compliance and PAGCOR regulatory requirements, and applies heightened security measures to its storage and handling.
3.4 We do not knowingly collect or store full payment card numbers, full GCash PINs, or full Maya account passwords. Payment authentication is handled directly by the respective payment providers.
4 Purposes of Processing
4.1 866gl processes your personal data only for the specific, legitimate purposes set out below. We do not use your personal data for any purpose that is incompatible with the purposes for which it was originally collected.
- Account Registration and Management: To create and maintain your 866gl account, authenticate your identity at login, and manage your account preferences and settings.
- KYC and Age Verification: To verify that you are at least 21 years of age, to confirm your identity, and to satisfy PAGCOR regulatory requirements for player identification.
- Transaction Processing: To process deposits and withdrawals via GCash, Maya, InstaPay, and other supported Philippine payment methods, and to maintain accurate financial records.
- Game and Betting Services: To provide, operate, and improve the casino games, live dealer tables, sports betting, bingo, and other services offered on the Platform.
- AML/CFT Compliance: To detect, investigate, and prevent money laundering, fraud, and other financial crimes as required under Republic Act No. 9160 (Anti-Money Laundering Act) and related regulations.
- Customer Support: To respond to your inquiries, resolve complaints, and provide technical assistance via live chat, email, and other support channels.
- Responsible Gaming: To monitor for indicators of problem gambling behaviour, administer self-exclusion requests and deposit limits, and fulfil PAGCOR's responsible gaming requirements.
- Security and Fraud Prevention: To protect the Platform and our users from unauthorised access, account takeover, bonus abuse, and other fraudulent activity.
- Legal and Regulatory Compliance: To comply with applicable Philippine laws, respond to lawful requests from PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, and other competent authorities.
- Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the performance, design, and functionality of the 866gl Platform.
- Marketing Communications (with consent): To send you promotional offers, bonus notifications, and platform updates where you have expressly opted in to receive such communications.
5 Legal Basis for Processing
5.1 866gl processes your personal data on the following legal bases as provided under the DPA and its Implementing Rules:
- Contractual Necessity: Processing is necessary to perform the contract between you and 866gl (i.e., the Terms & Conditions) — including account management, game provision, and payment processing.
- Legal Obligation: Processing is necessary to comply with our legal obligations under the DPA, the Anti-Money Laundering Act, PAGCOR regulations, and other applicable Philippine laws.
- Legitimate Interest: Processing is necessary for the legitimate interests of 866gl, including fraud prevention, Platform security, responsible gaming monitoring, and service improvement, provided such interests are not overridden by your rights and freedoms.
- Consent: Where we rely on consent — in particular for optional marketing communications — you have the right to withdraw that consent at any time by updating your account preferences or by contacting our support team.
6 Sharing Your Personal Data
6.1 We may share your personal data with the following categories of third parties, in each case solely to the extent necessary for the stated purpose:
- Payment Processors: GCash (GXI, Inc.), Maya (PayMaya Philippines, Inc.), BancNet, InstaPay operators, and other licensed Philippine payment service providers, for the purpose of processing your deposits and withdrawals.
- Identity Verification Providers: Third-party KYC and age verification service providers engaged by 866gl to assist in fulfilling PAGCOR regulatory requirements. These providers are bound by confidentiality and data processing agreements.
- Game Providers: Software and game content providers (such as Pragmatic Play, PG Soft, and Jili) who operate games accessible through the 866gl Platform. Game providers receive limited technical data necessary to deliver game sessions and may process game outcome data in accordance with their own data processing agreements with 866gl.
- Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by law, court order, or official regulatory direction.
- IT and Infrastructure Providers: Cloud hosting providers, cybersecurity vendors, and technical service providers engaged to support the operation and security of the 866gl Platform. All such providers are bound by contractual data protection obligations.
- Professional Advisers: Legal, audit, and compliance advisers, where disclosure is necessary in connection with the provision of professional advice to 866gl.
6.2 Where we share data with third-party processors, we enter into written data processing agreements that require those processors to handle your data only in accordance with our instructions and in compliance with the DPA.
7 Data Retention
7.1 866gl retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following general retention periods apply:
- Account Data and KYC Records: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and Anti-Money Laundering Act obligations.
- Transaction and Betting Records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLC regulations.
- Customer Support Records: Retained for a minimum of three (3) years from the date of the last interaction, or longer if related to an ongoing legal matter or formal complaint.
- Technical and Log Data: Retained for a maximum of twelve (12) months from the date of collection, unless retention is required for security investigations or legal proceedings.
- Marketing Consent Records: Retained for the duration of your account and for three (3) years following account closure, to demonstrate compliance with consent requirements.
7.2 At the end of the applicable retention period, personal data is securely deleted or anonymised in accordance with 866gl's data lifecycle management procedures.
8 Security Measures
8.1 866gl implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:
- 256-bit TLS/SSL encryption for all data transmitted between your device and the Platform;
- Encryption at rest for stored sensitive personal information and financial data;
- One-way cryptographic hashing for all account passwords (passwords are never stored in plain text);
- Tokenisation of payment details — 866gl does not store full GCash or Maya account numbers;
- Two-factor authentication (2FA) available for all user accounts via SMS OTP;
- Role-based access controls limiting employee access to personal data on a need-to-know basis;
- Regular security vulnerability assessments and penetration testing;
- 24/7 intrusion detection and monitoring of the Platform's infrastructure;
- Staff training on data protection and security obligations.
8.2 Data Breach Response. In the event of a personal data breach that is likely to prejudice the rights and freedoms of data subjects, 866gl will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected users as required by the DPA and NPC Circular No. 16-03.
8.3 While we implement industry-standard security measures, no internet transmission is completely secure. You are responsible for maintaining the security of your own account credentials and for notifying 866gl immediately if you suspect unauthorised access to your account.
9 Cookies and Tracking Technologies
9.1 866gl uses cookies and similar tracking technologies on the Platform to support essential functionality, analyse usage, and — where you have consented — to deliver relevant promotional content.
9.2 The categories of cookies we use are as follows:
- Strictly Necessary Cookies: Essential to the operation of the Platform, including session management, login authentication, and security functions. These cannot be disabled without affecting Platform functionality.
- Functional Cookies: Remember your preferences (such as language settings, preferred game lobby view, and "Keep me signed in" selections) to provide a more personalised experience.
- Analytics Cookies: Collect anonymised data about how users interact with the Platform — which pages are visited, how long sessions last, and which features are used — to help us improve the Platform. Used only with your consent.
- Marketing Cookies: Used to deliver relevant promotional messaging across the Platform where you have opted in to marketing communications. These are not used to track your browsing behaviour outside of 866gl.app.
9.3 You may manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies may prevent some Platform features from functioning correctly.
10 Minors and Age Policy
10.1 866gl implements age verification procedures at the point of account registration and as part of the KYC process to confirm that all registered users are at least 21 years of age, in compliance with PAGCOR regulations.
10.2 If 866gl becomes aware that personal data has been collected from an individual who is under 21 years of age, it will immediately suspend the relevant account, delete or securely isolate the associated personal data, and take appropriate steps to comply with PAGCOR's requirements regarding underage access.
10.3 If you are a parent or guardian and believe that a minor may have registered an account on the 866gl Platform, please contact our Data Protection Officer immediately at the details set out in Section 16.
11 Your Data Privacy Rights
11.1 Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data processed by 866gl. You may exercise any of these rights by submitting a written request to our Data Protection Officer at the contact details in Section 16.
Right to Access
Request a copy of the personal data we hold about you and information about how it is being processed.
Right to Correction
Request correction of inaccurate or incomplete personal data. You may also update certain data directly in your account settings.
Right to Erasure
Request deletion of your personal data where it is no longer necessary, or where you withdraw consent — subject to our legal retention obligations.
Right to Object
Object to processing of your personal data based on legitimate interests or for direct marketing purposes. Objections to essential processing may affect your ability to use the Platform.
Right to Data Portability
Request a structured, machine-readable copy of personal data you have provided to 866gl, where technically feasible and permitted under applicable law.
Right to be Informed of Breach
Be notified in the event that your personal data is involved in a security breach that poses a real risk of serious harm, as required by the DPA and NPC regulations.
11.2 How to Exercise Your Rights. Submit your request in writing to our DPO at [email protected] with the subject line "Data Privacy Request". We will acknowledge your request within 72 hours and will respond substantively within fifteen (15) business days of receipt. Identity verification may be required before the request can be processed.
11.3 Right to Complain. If you are not satisfied with our response to a privacy request, you have the right to lodge a complaint with the National Privacy Commission at https://www.privacy.gov.ph (note: this is an informational reference only; 866gl does not maintain this external website).
12 Cross-Border Data Transfers
12.1 Where personal data is transferred to or processed by service providers located outside the Philippines — for example, international game providers or cloud infrastructure partners with data centres outside the country — 866gl ensures that such transfers are conducted in compliance with Section 21 of the DPA and the NPC's rules on cross-border data flow.
12.2 Appropriate safeguards for cross-border transfers include contractual data processing agreements that impose DPA-equivalent obligations on the overseas recipient, and transfer impact assessments where required by NPC guidelines.
12.3 Where possible, 866gl limits cross-border transfers and prioritises service providers capable of processing data within Philippine jurisdiction.
13 Marketing Communications
13.1 866gl will send you promotional messages, bonus offers, and platform updates by SMS or email only where you have expressly opted in to receive such communications during registration or through your account settings.
13.2 Withdrawing Consent. You may opt out of marketing communications at any time by: (a) updating your marketing preferences in your 866gl account settings; or (b) contacting Customer Support or the DPO and requesting removal from marketing communications. Opt-out requests are processed within five (5) business days.
13.3 Opting out of marketing communications does not affect your receipt of transactional messages — such as deposit confirmations, withdrawal notifications, and security alerts — which are sent as part of the operation of your account and do not require separate consent.
14 Third-Party Links and Services
14.1 The 866gl Platform does not contain links to external third-party websites. However, certain integrated services — such as live game streams from third-party providers — involve data processing by those providers in accordance with their own privacy policies and data processing agreements with 866gl.
14.2 866gl is not responsible for the privacy practices of third-party game providers operating within the Platform's game lobby. Players with concerns about a specific game provider's data practices may contact 866gl's DPO for information about the relevant data processing agreement in place.
15 Changes to This Privacy Policy
15.1 866gl may update this Privacy Policy from time to time to reflect changes in applicable law, NPC guidance, PAGCOR requirements, or our data processing practices. The effective date of the current version is shown in the "Last Updated" notice at the top of this page.
15.2 Where changes to this Policy are material — for example, where we begin processing your data for a new purpose or share it with a new category of third party — 866gl will notify registered users via on-platform notification or SMS before the changes take effect.
15.3 Your continued use of the 866gl Platform following the effective date of an updated Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree with changes to this Policy, you may close your account by contacting Customer Support.
16 Contact and Data Protection Officer
16.1 For any questions, concerns, or requests relating to this Privacy Policy or 866gl's processing of your personal data, please contact our Data Protection Officer:
- DPO Email: [email protected] (subject line: "Data Privacy Request" or "Privacy Inquiry")
- Live Chat: Available 24/7 within your logged-in 866gl account dashboard.
- Response Time: DPO acknowledges requests within 72 hours; substantive responses within 15 business days.
16.2 If you wish to lodge a formal complaint regarding 866gl's handling of your personal data that has not been resolved through our internal process, you may contact the National Privacy Commission (NPC) of the Philippines. The NPC's contact information is publicly available at the NPC's official government website.