naceph Privacy Policy

naceph ("we," "us," or "our") operates the online gaming platform accessible at naceph.bet (the "Platform"). This Privacy Policy explains how naceph collects, uses, stores, discloses, and protects the personal data of individuals who register for an account, visit our website, or otherwise interact with our Platform (collectively, "Players" or "you").

This Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines. It should be read together with naceph's Terms and Conditions, which govern your use of the Platform.

This Policy applies to all personal data collected through the Platform, whether through web browsers, mobile browsers, or any other digital access points provided by naceph. It does not apply to third-party websites or services that may be linked to or from our Platform.

naceph is the personal information controller (PIC) with respect to the personal data processed through the Platform, as that term is defined under the Data Privacy Act of 2012. naceph determines the purposes and means by which your personal data is collected and processed.

naceph operates under a valid license issued by the Philippine Amusement and Gaming Corporation (PAGCOR), which also imposes its own data governance obligations on licensed operators. Our data processing activities are subject to both the DPA and PAGCOR's regulatory requirements.

naceph has appointed a Data Protection Officer (DPO) who is responsible for:

• Overseeing naceph's compliance with the Data Privacy Act and NPC issuances.
• Serving as the primary point of contact for data subject requests and complaints.
• Liaising with the National Privacy Commission on matters of data protection.
• Conducting and maintaining the Privacy Impact Assessment (PIA) for the Platform.

You may contact the DPO directly at [email protected] with the subject line "Data Protection Officer — [Your Request]."

naceph collects the following categories of personal data, depending on how you interact with the Platform:

naceph does not intentionally collect sensitive personal information (as defined under Section 3(l) of the DPA) such as health data, political opinions, religious beliefs, or biometric data, except where government-issued IDs submitted for KYC incidentally contain such information. In that case, naceph processes only the data elements necessary for identity verification purposes.

naceph collects personal data through the following means:

• Direct Submission: When you register for an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or participate in a promotion, you directly provide personal data to naceph.
• Automated Collection: naceph's Platform automatically collects technical and usage data through server logs, session cookies, and analytics tools when you access and interact with the website.
• Payment Processors: When you initiate a GCash, Maya, BPI, BDO, or other payment transaction, naceph receives confirmation data from the payment processor, including the registered account name and transaction reference, to verify and reconcile the transaction.
• KYC Verification Partners: naceph may use third-party identity verification service providers to assist with document authentication and liveness detection as part of the KYC process. These providers supply naceph with a verification result and confidence score.
• Fraud Prevention Systems: naceph's automated fraud detection tools analyze behavioral patterns, device fingerprints, and IP geolocation data to identify suspicious activity. This data is generated passively during your use of the Platform.

naceph processes your personal data for the following specific and legitimate purposes:

• Account Registration and Management: To create and maintain your naceph account, authenticate your identity at login, and administer your account preferences and settings.
• KYC and Identity Verification: To comply with PAGCOR licensing requirements and Republic Act No. 9160 (Anti-Money Laundering Act), naceph verifies the identity of all players before processing withdrawal transactions.
• Payment Processing: To process deposits and withdrawals in Philippine Peso through GCash, Maya, GrabPay, BPI, BDO, Metrobank, and other supported payment channels.
• Game Delivery and Fair Play: To deliver casino games, sports betting markets, bingo, and e-sports content; to record bet and game outcomes; and to detect and prevent cheating, collusion, or exploitation of system errors.
• Regulatory Compliance: To fulfill naceph's obligations under PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine laws. This includes generating and retaining required transaction records.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, bonus abuse, and other prohibited conduct as defined in the Terms and Conditions.
• Customer Support: To respond to your inquiries, resolve disputes, process complaints, and provide assistance through live chat, email, and other support channels.
• Responsible Gaming: To monitor gambling behavior patterns, apply player-requested deposit limits and self-exclusion restrictions, and ensure compliance with naceph's responsible gaming obligations under PAGCOR guidelines.
• Marketing Communications (with consent): To send you promotional offers, bonus notifications, and product updates by email, SMS, or push notification, where you have provided your explicit consent to receive such communications.
• Platform Improvement: To analyze aggregated usage data and improve the functionality, security, and content of the naceph Platform.

Under the Data Privacy Act of 2012, naceph processes your personal data on the following legal grounds:

• Contractual Necessity: Processing of identity data, contact data, financial data, and account data is necessary for naceph to perform its contractual obligations to you under the Terms and Conditions, including account administration, game delivery, and payment processing.
• Legal Obligation: Processing for KYC verification, AML transaction monitoring, and record-keeping is required by Philippine law, including Republic Act No. 9160 and PAGCOR's regulatory framework. naceph has no discretion to opt out of these obligations.
• Legitimate Interests: Processing of technical data, usage data, and fraud signals is based on naceph's legitimate interest in maintaining the security, integrity, and fair operation of the Platform, provided this does not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications and optional analytics is based on your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

naceph does not sell your personal data. naceph may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Processors: GCash (GXI), Maya (Voyager Innovations), GrabPay, BPI, BDO, Metrobank, and other payment service providers receive the minimum data necessary to process your transactions and comply with their own AML obligations.
• KYC and Identity Verification Providers: Third-party identity verification partners receive your submitted ID documents and selfie images for the purpose of authenticating your identity. These providers are contractually bound to process data only for verification purposes.
• Game Content Providers: Where naceph integrates third-party game studios, limited usage data (such as a player identifier and session token) may be shared to deliver game content and settle game results. No directly identifiable personal data such as your name or address is shared with game providers.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government authorities may receive your personal data where naceph is legally required to report, disclose, or cooperate with official investigations.
• Professional Advisers: naceph's legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis, subject to confidentiality obligations.
• IT Infrastructure Providers: naceph uses cloud hosting and content delivery services to operate the Platform. These providers process personal data as data processors under contract with naceph and are prohibited from using the data for their own purposes.

naceph uses cookies and similar tracking technologies on the Platform to support core functionality, enhance your experience, and analyze usage patterns. The following types of cookies may be used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They maintain your login session, remember your language preference, and ensure secure navigation. You cannot opt out of strictly necessary cookies without ceasing to use the Platform.
• Functional Cookies: These cookies remember choices you have made — such as your preferred game category or responsible gaming settings — so that naceph can provide a more personalized experience on your next visit.
• Analytics Cookies: naceph uses analytics tools to understand how players interact with the Platform, which pages are most visited, and where technical issues may occur. Analytics data is aggregated and does not identify you individually. You may opt out of analytics cookies through the cookie preference center.
• Security Cookies: naceph uses device fingerprinting and behavioral analytics cookies to identify unusual login patterns, detect account takeover attempts, and flag suspicious betting behavior for fraud review.

You can manage your cookie preferences through your browser settings or our cookie preference center. Please note that disabling certain cookies may affect the functionality of the Platform, including your ability to log in or place bets.

naceph does not use third-party advertising cookies or behavioral retargeting technologies that share your data with ad networks.

naceph retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Philippine law. The following retention periods apply:

After the applicable retention period, naceph will securely delete or anonymize your personal data. Where data is anonymized, it may be retained indefinitely for statistical analysis purposes as it can no longer be used to identify you.

naceph implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• Transport Layer Security (TLS 1.2 or higher) encryption for all data transmitted between your device and our servers.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Bcrypt hashing of all player passwords — naceph never stores your password in plaintext.
• Role-based access controls (RBAC) that restrict naceph staff access to personal data on a strict need-to-know basis.
• Multi-factor authentication requirements for naceph personnel accessing internal systems that contain player data.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• 24/7 monitoring of the Platform infrastructure for security anomalies and intrusion attempts.

While naceph takes all reasonable precautions, no system is completely immune to security threats. You are also responsible for protecting your own account credentials and should use a strong, unique password and enable any available two-factor authentication on your naceph account.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by naceph:

To exercise any of these rights, please submit a written request to naceph's Data Protection Officer at [email protected] with the subject line "Data Subject Request — [Right]." naceph will verify your identity before processing any request. Please note that certain rights may be limited where naceph is required to retain data under Philippine law, including AML and PAGCOR record-keeping obligations.

If you believe naceph has violated your data privacy rights, you may file a complaint with the National Privacy Commission (NPC) of the Philippines through its official government channels.

The naceph Platform is strictly intended for individuals who are at least 21 years of age, in accordance with PAGCOR's age restriction requirements for casino-style online gambling in the Philippines. naceph does not knowingly collect personal data from individuals under 21 years of age.

Age verification is conducted as part of the KYC process for all players before withdrawal transactions are permitted. If naceph discovers that an account has been registered by a person under 21 years of age, the account will be immediately suspended, all funds will be frozen, and the personal data collected will be deleted to the extent not required for regulatory reporting purposes.

naceph primarily processes and stores personal data within data centers located in the Philippines or within the Asia-Pacific region. However, certain third-party service providers — including cloud infrastructure providers and game content studios — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside of the Philippines, naceph ensures that appropriate safeguards are in place to protect your data, including:

• Contractual clauses that impose data protection obligations equivalent to those required under the Data Privacy Act of 2012.
• Selection of service providers located in jurisdictions recognized by the NPC as providing an adequate level of protection for personal data.
• Data processing agreements that prohibit onward transfers without naceph's prior written consent.

You may request information about the specific safeguards applicable to any cross-border transfer of your personal data by contacting the DPO at [email protected].

naceph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. Material changes to this Policy will be communicated to registered players via email to the address on file and/or through a prominent notice on the Platform at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this page will be revised whenever this Policy is amended. Your continued use of the Platform following the effective date of any amendment constitutes acceptance of the updated Policy.

naceph encourages all players to review this Privacy Policy periodically. Prior versions of this Policy may be requested from the DPO at [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or naceph's data processing practices, please contact our Data Protection Officer:

If you are not satisfied with naceph's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines through its official government channels.

This Privacy Policy was last reviewed and updated on January 1, 2026. naceph encourages you to retain a copy of this Policy for your own records.