xoplay Privacy Policy

1 Who We Are

This Privacy Policy is issued by xoplay ("xoplay", "we", "us", "our"), the operator of the online gaming platform accessible at https://xoplay.ws. xoplay is the data controller responsible for the personal data of registered players and website visitors in the Philippines and is committed to protecting that data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA") and the rules and regulations of the National Privacy Commission ("NPC").

This Privacy Policy applies to all personal data collected through the xoplay website, mobile browser experience, customer support channels, KYC verification processes, and any other interaction you have with xoplay as a registered player or prospective player based in the Philippines — whether you are accessing the platform from Metro Manila, Cebu, Davao, Quezon City, Makati, or anywhere else in the Philippine archipelago.

2 Data We Collect

xoplay collects the following categories of personal data from players and website visitors. The specific data collected at any point depends on the nature of your interaction with the xoplay platform and the stage of the account lifecycle you are in.

3 How We Collect Your Data

xoplay collects personal data through the following channels and mechanisms:

• Direct collection: Data you provide when creating an xoplay account, completing the KYC verification process, making deposits or withdrawal requests, contacting customer support, or responding to xoplay surveys and promotions.
• Automated technical collection: Technical data collected automatically when you access the xoplay website or platform, including IP address, device identifiers, browser fingerprint, and session data, via cookies and server-side logging systems.
• Payment processors: Transaction confirmation data received from GCash, PayMaya, BDO, BPI, and Metrobank when you initiate a deposit or withdrawal. xoplay receives only the data necessary to reconcile the transaction; full banking credentials are never shared with xoplay.
• KYC verification providers: Identity verification services used by xoplay to cross-check submitted documents against authoritative Philippine government databases, where applicable, in compliance with PAGCOR and AMLC requirements.
• Analytics and fraud prevention tools: Aggregated and pseudonymised data from platform analytics tools used to detect fraudulent activity, multi-accounting, and other prohibited conduct, as described in the xoplay Terms and Conditions.

4 Why We Process Your Data

xoplay processes your personal data for the following specific, legitimate purposes. Each purpose is tied to a legal basis for processing as described in Section 5 below.

• Account creation and management: To register your xoplay account, verify your identity, authenticate your login sessions, and manage your player profile throughout your relationship with xoplay.
• KYC and age verification: To verify that you are at least 21 years of age and to comply with xoplay's KYC obligations under PAGCOR regulations and Philippine anti-money laundering laws.
• Payment processing: To process deposits and withdrawal requests securely, reconcile transactions, and maintain accurate financial records in accordance with Philippine accounting and regulatory requirements.
• Game delivery and personalisation: To deliver the xoplay gaming experience, track your wagering activity for responsible gaming purposes, and present game recommendations relevant to your activity on the platform.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the xoplay Terms and Conditions.
• Responsible gaming monitoring: To monitor gaming activity for signs of problem gambling and to administer the responsible gaming tools available to xoplay players, including deposit limits, loss limits, and self-exclusion.
• Customer support: To respond to your queries, complaints, and requests for assistance via live chat, email, or other support channels operated by xoplay.
• Legal and regulatory compliance: To comply with xoplay's obligations under Philippine law, including tax reporting, PAGCOR regulatory requirements, and AMLC reporting obligations.
• Marketing (with consent): To send you promotional offers, bonus notifications, and platform updates via SMS, email, or push notification where you have given your explicit consent to receive such communications.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012 and its implementing rules, xoplay processes your personal data on one or more of the following legal bases depending on the specific processing activity:

6 Data Sharing & Disclosure

xoplay does not sell, rent, or trade your personal data to any third party for their independent commercial purposes. xoplay shares your personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: GCash, PayMaya, BDO, BPI, and Metrobank receive only the transaction data necessary to process your deposit or withdrawal. These providers are independently regulated and maintain their own privacy policies.
• KYC verification providers: Third-party identity verification service providers engaged by xoplay receive your identity documents and personal details solely for the purpose of completing your KYC verification. These providers are bound by data processing agreements requiring compliance with RA 10173.
• Game software providers: Third-party game providers integrated into the xoplay platform may receive pseudonymised player session data (such as a session token and bet data) necessary to deliver their game content. Full identity data is not shared with game providers.
• Fraud prevention partners: Anti-fraud and security service providers may process technical data (such as IP addresses and device fingerprints) on xoplay's behalf for the purpose of detecting and preventing fraudulent activity.
• Regulatory and law enforcement authorities: xoplay is required by Philippine law to disclose certain player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and law enforcement authorities upon receipt of a lawful request or pursuant to a court order.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or substantially all of the assets of xoplay, your personal data may be transferred to the successor entity, subject to equivalent data protection commitments.

7 International Data Transfers

Where xoplay transfers your personal data outside the Republic of the Philippines — for example, to international game providers, cloud infrastructure providers, or KYC technology vendors — xoplay ensures that such transfers are conducted in compliance with the cross-border data transfer requirements of RA 10173 and the relevant NPC rules.

Specifically, international transfers are only made where at least one of the following safeguards is in place:

• The recipient country has been assessed as providing an adequate level of data protection comparable to that required by Philippine law.
• xoplay has entered into a data processing agreement with the recipient that includes standard contractual clauses approved or recognised by the NPC.
• The transfer is strictly necessary for the performance of a contract between you and xoplay (for example, processing a payment through an international payment network).

8 Data Retention

xoplay retains your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable Philippine law. The following retention periods apply as a general framework:

On expiry of the applicable retention period, xoplay will securely delete or anonymise your personal data in a manner that prevents reconstruction. Where anonymisation is used, the resulting data may be retained indefinitely for aggregate analytics purposes as it no longer constitutes personal data under RA 10173.

9 Cookies & Tracking Technologies

xoplay uses cookies and similar tracking technologies on the xoplay website and platform to ensure the site functions correctly, to maintain your login session, to detect fraud, and — where you have consented — to deliver personalised content and measure the effectiveness of our promotions.

• Strictly necessary cookies: Required for the xoplay platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. You cannot opt out of these while using xoplay.
• Functional cookies: Remember your preferences (such as language or notification settings) to enhance your experience on xoplay. Disabled by default; enabled when you configure preferences.
• Analytics cookies: Used by xoplay's internal analytics system to understand aggregate platform usage patterns. Data is pseudonymised. Requires your consent and can be disabled in your xoplay cookie settings.
• Marketing cookies: Track whether you have engaged with an xoplay promotion for attribution purposes. Requires explicit consent and can be withdrawn at any time through your cookie preference settings on the xoplay platform.

10 Your Privacy Rights

Under the Data Privacy Act of 2012 (RA 10173), xoplay players in the Philippines have the following rights in relation to their personal data. These rights may be exercised by contacting xoplay's Data Privacy Officer using the contact details in Section 15.

11 Data Security

xoplay implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures are reviewed and updated on a regular basis in line with evolving security standards and threats.

• Encryption at rest: All personal data stored on xoplay infrastructure is encrypted using AES-256 encryption. Payment tokenisation is used so that no raw financial credentials are stored on xoplay servers.
• Encryption in transit: All data transmitted between your device and xoplay is protected by TLS 1.3 encryption. HTTP connections are automatically redirected to HTTPS.
• Access controls: Access to personal data within xoplay is restricted on a strict need-to-know basis. All internal access to player data is logged and subject to regular audit.
• Vulnerability management: xoplay conducts regular security assessments, penetration testing, and vulnerability scanning of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Breach notification: In the event of a personal data breach that poses a real risk of serious harm, xoplay will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will notify affected players without undue delay, in accordance with RA 10173 and NPC Circular 16-03.

12 Children & Minors

xoplay is strictly an adults-only platform. In accordance with PAGCOR regulations and Philippine law, all gaming activities on xoplay are available only to persons who are 21 years of age or older. xoplay does not knowingly collect, process, or retain personal data from any individual under 21 years of age.

Age verification is conducted as part of the mandatory KYC process that every xoplay player must complete before being permitted to deposit funds or access real-money games. Any account found to belong to a player under the age of 21 will be immediately suspended, all funds will be returned, and any winnings will be forfeited in accordance with the xoplay Terms and Conditions.

13 Marketing Communications

xoplay will only send you marketing communications — including promotional offers, bonus notifications, new game announcements, and event updates — where you have given your explicit, freely given, informed, and specific consent to receive such communications at the time of registration or through your account settings.

You may opt out of marketing communications from xoplay at any time using any of the following methods:

• Account settings: Update your marketing communication preferences directly in the Notifications section of your xoplay account settings at any time.
• Email unsubscribe: Click the unsubscribe link included in the footer of every xoplay marketing email to remove yourself from xoplay's marketing email list.
• SMS opt-out: Reply STOP to any xoplay marketing SMS to unsubscribe from SMS marketing communications immediately.
• Customer support: Contact xoplay's 24/7 live chat support and request removal from all marketing communications. Your request will be processed within 5 business days.

Please note that opting out of marketing communications will not affect xoplay's ability to send you transactional messages necessary for the operation of your account, such as deposit confirmations, withdrawal notifications, security alerts, and KYC status updates.

14 Changes to This Policy

xoplay reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. All changes will take effect upon publication of the updated Privacy Policy on the xoplay website.

Where a proposed change to this Privacy Policy is material — meaning it significantly affects how xoplay processes your personal data or reduces your rights — xoplay will provide advance notice of the change via email to the address registered on your xoplay account at least 14 days before the change takes effect. Your continued use of xoplay following the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms.

15 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights under RA 10173, or want to raise a concern about how xoplay handles your personal data, please contact xoplay's Data Privacy Officer using the following details:

If you are not satisfied with xoplay's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines, which is the competent supervisory authority for data protection matters under RA 10173. Information on how to file a complaint with the NPC is available on the NPC's official government website.