million88
Privacy Policy

million88 is committed to protecting the privacy and personal data of all players who use the million88.one platform. This Privacy Policy sets out the basis on which million88 collects, processes, stores, shares, and protects the personal information of registered users and visitors in the Philippines.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, referred to as the "DPA"), its Implementing Rules and Regulations (IRR), and the regulations issued by the National Privacy Commission of the Philippines (NPC). It also reflects million88's obligations under PAGCOR's data governance requirements applicable to licensed online gambling operators.

This Privacy Policy should be read together with the million88 Terms and Conditions, which govern the overall relationship between million88 and its registered players. Both documents are incorporated into the player registration agreement.

For the purposes of the Data Privacy Act of 2012, million88 acts as the Personal Information Controller (PIC) with respect to all personal data collected through the million88.one platform. As PIC, million88 determines the purposes for which personal data is processed and the means by which such processing is carried out.

Where million88 engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification vendors, cloud hosting providers, and customer support platforms — those providers act as Personal Information Processors (PIPs) under written data processing agreements that impose data protection obligations equivalent to those in this Privacy Policy.

Contact details for data privacy enquiries and the exercise of data subject rights are set out in Section 17 of this Policy.

million88 collects the following categories of personal data from players and platform users:

3.1 Registration and Identity Data

• Full legal name (as it appears on a Philippine government-issued ID)
• Date of birth
• Gender (optional)
• Philippine mobile telephone number
• Email address
• Residential address
• Nationality

3.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., PhilSys National ID, Passport, Driver's License, SSS ID, UMID, Voter's ID)
• Proof of address documentation
• Selfie or biometric photograph (for remote identity verification)
• Source of funds documentation (for large transaction compliance)

3.3 Financial and Transaction Data

• GCash or Maya account number (masked; stored by payment processor)
• Bank account details for bank transfer transactions (masked)
• Transaction history: deposits, withdrawals, bet amounts, win/loss records
• Bonus and promotional credit history

3.4 Usage and Behavioural Data

• Games played, bet sizes, session duration, and session frequency
• Device type, operating system, browser type, screen resolution
• IP address and approximate geolocation derived from IP
• Login timestamps and logout timestamps
• Customer support interaction history (chat logs, email correspondence)

3.5 Responsible Gaming Data

• Deposit limits and loss limits set by the player
• Self-exclusion status and duration
• Cooling-off period records
• Responsible gaming assessment responses (where provided voluntarily)

million88 collects personal data through the following means:

• Directly from you: Information you provide during account registration, KYC verification submission, customer support interactions, survey responses, and promotional opt-in forms.
• Automatically through platform use: Technical data collected automatically when you access million88.one, including IP address, device identifiers, browser information, and session activity logs.
• From payment providers: Confirmation data returned by GCash, Maya, BPI, BDO, Metrobank, and other payment providers when you initiate a deposit or withdrawal transaction.
• From identity verification services: Results of third-party KYC and age verification processes undertaken to comply with PAGCOR and AMLA requirements.
• From fraud prevention services: Risk scores and flagging data from third-party fraud detection providers used to protect the security of your account and the platform.

million88 processes personal data for the following documented purposes:

Under the Data Privacy Act of 2012 and its IRR, million88 processes personal data on the following lawful bases:

• Performance of a contract: Processing necessary to fulfil the player account agreement — including account creation, game delivery, and payment processing — is carried out on the basis that it is necessary for the performance of the contract between you and million88.
• Compliance with a legal obligation: Processing required to comply with Philippine law, including PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) obligations, and orders from competent Philippine government authorities.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics is carried out on the basis of million88's legitimate interests, where those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and optional data uses is carried out on the basis of your freely given, specific, and informed consent. Consent may be withdrawn at any time without detriment to your account's non-marketing functions.

million88 does not sell your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

• Payment service providers: GCash, Maya, BPI, BDO, Metrobank, and other payment processors receive the minimum necessary data to process your deposit or withdrawal transaction. These providers are bound by their own privacy policies and applicable PCI-DSS requirements.
• KYC and identity verification providers: Third-party verification services receive identity document images and personal details for the purpose of satisfying PAGCOR and AMLA age and identity verification requirements.
• Game content providers: Game providers (such as Pragmatic Play, Jili, NetEnt, and others) may receive a pseudonymous player identifier and session data necessary to operate the game content within the million88 platform. They do not receive your full name, contact details, or financial information.
• Cloud infrastructure and hosting providers: Platform data is hosted on cloud infrastructure where providers act as processors under contractual data processing agreements.
• Customer support platform providers: Support interaction data is processed through third-party customer support software under data processing agreements.
• Regulatory and law enforcement authorities: Where required by Philippine law, PAGCOR regulations, or a valid court order, million88 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine authorities. million88 will notify you of such disclosures to the extent legally permitted.
• Fraud prevention networks: Anonymised or pseudonymised fraud signals may be shared with industry fraud prevention services to protect the platform and players from criminal activity.

Some of million88's service providers and game content partners operate infrastructure outside the Philippines. Where personal data is transferred to processors or sub-processors located outside the Philippines, million88 ensures that such transfers are subject to appropriate safeguards, which may include:

• Standard contractual clauses approved by the National Privacy Commission or equivalent internationally recognised clauses
• Contractual data processing agreements incorporating equivalent privacy and security standards
• Processing within jurisdictions that the NPC has recognised as providing adequate data protection

million88 maintains a register of all cross-border data transfers and the safeguards applied to each. Players may request information about specific transfers by contacting the Data Protection Officer at the details in Section 17.

million88 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

9.1 Technical Controls

• AES-256 encryption for personal data stored in million88 databases
• TLS 1.2 or higher for all data in transit between player devices and million88 servers
• Multi-factor authentication requirements for administrative access to production systems
• Web application firewalls (WAF) and intrusion detection systems
• Regular vulnerability assessments and penetration testing by independent security specialists
• Automated logging and monitoring of access to systems holding personal data

9.2 Organisational Controls

• Formal data protection policies and procedures applicable to all staff
• Role-based access controls — staff access personal data only to the extent necessary for their job functions
• Data protection training for all staff with access to personal data
• Third-party vendor security assessments before onboarding as processors
• A documented data incident response plan

million88 retains personal data for as long as necessary for the purposes for which it was collected, or for longer periods where required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer identify you. Players who close their accounts may request confirmation of data deletion after the mandatory regulatory retention period has elapsed.

million88 uses cookies and similar tracking technologies on the million88.one platform. These fall into the following categories:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, load balancing cookies, and security tokens. These cannot be disabled without breaking platform functionality.
• Functional cookies: Remember your preferences (e.g., language, last visited game category) to enhance your experience. These are set on the basis of legitimate interests.
• Analytics cookies: Collect anonymised data on how players interact with million88.one to help us improve the platform. Set only with your consent.
• Fraud prevention tokens: Device fingerprinting tokens used to detect and prevent unauthorised access attempts and fraudulent account activity. Set on the basis of legitimate interests and security obligations.

You may manage cookie preferences through the cookie consent banner presented on your first visit to million88.one, or through your browser's cookie settings. Disabling strictly necessary cookies will prevent you from logging in and using the platform.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by million88:

To exercise any of these rights, contact the million88 Data Protection Officer using the details in Section 17. million88 will respond to rights requests within fifteen (15) calendar days of receipt. We may need to verify your identity before processing the request to prevent unauthorised access to account data.

million88 may send promotional communications — including bonus offers, game announcements, and special events — to players who have explicitly opted in to receive such communications during registration or through account settings.

You may withdraw your marketing consent at any time through the following methods:

• Clicking the "Unsubscribe" link in any marketing email from million88
• Updating your communication preferences in Account Settings → Notifications
• Contacting customer support via live chat or at [email protected] and requesting removal from marketing communications

Withdrawal of marketing consent will take effect within five (5) business days. Withdrawing consent for marketing does not affect your receipt of transactional account communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent on the basis of contract performance and legal obligation rather than consent.

The million88 platform is strictly prohibited to persons under the age of twenty-one (21) years. million88 does not knowingly collect or process personal data from minors. This restriction is a non-negotiable requirement under PAGCOR regulations governing online gambling in the Philippines.

If million88 becomes aware that personal data has been collected from an individual under the age of 21, it will immediately close the associated account, void all transactions, and delete the personal data in question, subject to any applicable regulatory reporting obligations.

Parents or guardians who believe that a person under 21 has registered an account on million88 should contact [email protected] immediately. million88 will investigate and act on all such reports promptly.

In the event of a personal data breach that is reasonably likely to result in harm to data subjects, million88 will comply with all notification obligations under the Data Privacy Act of 2012 and NPC Circular No. 16-03 on Personal Data Breach Management. Specifically:

• million88 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of a breach that is likely to result in significant harm to data subjects.
• Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and interests.
• Breach notifications to data subjects will include a description of the nature of the breach, the data categories affected, likely consequences, and measures million88 is taking to address the breach.

million88 maintains a documented data incident response plan and conducts regular tabletop exercises to ensure its incident response capability is current and effective.

million88 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or the services we offer. When material changes are made, we will notify registered players by:

• Sending an email notification to the registered email address on your account
• Displaying a prominent notice on the million88.one platform
• Updating the "Effective date" at the top of this Privacy Policy

Continued use of the million88 platform after the effective date of a revised Privacy Policy constitutes acknowledgement of and consent to the updated terms. If you do not agree with any material change to this Policy, you should close your account before the effective date of the revision.

We recommend reviewing this Privacy Policy periodically to stay informed about how million88 protects your personal data.

For all matters relating to this Privacy Policy, the exercise of your data subject rights, or any data protection concerns, please contact the million88 Data Protection Officer through the following channels:

• Live Chat: Available 24/7 inside your million88 account dashboard — select "Privacy & Data" as the enquiry category for fastest routing to the DPO team.
• Email: [email protected] — mark the subject line as "Data Privacy Request" to ensure correct routing to the Data Protection Officer.
• Response time: All privacy-related requests are acknowledged within 5 business days and substantively responded to within 15 calendar days as required by the DPA IRR.

If you are unsatisfied with million88's response to your privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC) through the NPC's published complaints procedure.