if888 Privacy Policy 🔒

1 Data Controller Information

if888 is the data controller responsible for the personal information collected through the if888 platform at if888.app. As data controller, if888 determines the purposes and means by which your personal data is processed. if888 operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and is bound by the requirements of the Data Privacy Act of 2012 (RA 10173) and the implementing rules and regulations issued by the National Privacy Commission of the Philippines.

All formal data privacy correspondence, data subject rights requests, and privacy-related complaints should be directed to the if888 Data Protection Officer (DPO). Contact details for the DPO are provided in Section 13 of this Privacy Policy.

2 Data We Collect

if888 collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is processed. The categories of personal data we collect include, but are not limited to, the following:

3 How We Collect Your Data

3.1 Data You Provide Directly

The majority of the personal data if888 holds about you is information you provide directly when you interact with the platform. This includes data submitted during account registration, KYC verification document uploads, deposit and withdrawal requests, contact form submissions, live chat conversations, and marketing preference selections.

3.2 Data Collected Automatically

When you access and use the if888 platform, certain technical data is automatically collected through your browser and device. This includes your IP address, device identifiers, browser type, operating system, pages visited, session duration, and referring URLs. This data is collected using cookies, web beacons, server logs, and similar tracking technologies. Please refer to Section 8 of this Privacy Policy for more detail on how if888 uses cookies.

3.3 Data from Third Parties

if888 may receive personal data about you from third-party sources in certain circumstances, including:

• Payment processors (e.g., GCash, PayMaya, BPI, BDO, Metrobank, UnionBank) who confirm transaction status and account ownership.
• Identity verification service providers engaged to assist with KYC and age verification processes.
• Anti-fraud and anti-money laundering screening databases maintained by licensed third-party providers.
• PAGCOR and other regulatory bodies, to the extent that data sharing is required by law or regulation.

3.4 Data from Public Sources

In connection with our AML compliance obligations, if888 may consult publicly available information sources — including government databases and published sanctions or watchlists — to verify your identity and assess risk. This is conducted strictly within the scope permitted by applicable Philippine law.

4 Purpose & Legal Basis for Processing

if888 processes your personal data only where there is a lawful basis to do so under the Data Privacy Act of 2012. The primary purposes for which we process your personal data and the applicable legal basis for each are set out below:

5 Data Sharing & Disclosure

5.1 We Do Not Sell Your Data

if888 does not sell, rent, trade, or otherwise commercially transfer your personal data to third-party marketers, data brokers, or advertising networks. Your personal data is not a product. It is information we hold in trust and process only for the purposes described in this Privacy Policy.

5.2 Authorised Third-Party Service Providers

if888 engages reputable third-party service providers who process personal data on our behalf in order to deliver the platform's services. These processors are bound by data processing agreements that require them to handle your data with the same level of protection that if888 applies. Categories of processors include:

• Payment gateway and financial processing partners (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, Cebuana Lhuillier)
• Identity verification and KYC technology providers
• Cloud hosting and server infrastructure providers
• Fraud detection and cybersecurity service providers
• Customer support platform providers (live chat software)
• Email and SMS communications service providers
• Analytics and platform performance monitoring tools

5.3 Regulatory and Legal Disclosures

if888 may be required to disclose your personal data to government authorities, regulatory bodies, or law enforcement agencies under the following circumstances:

• To comply with a valid court order, subpoena, or legal process issued by a Philippine court.
• To fulfil mandatory reporting obligations to PAGCOR as the gaming regulatory authority.
• To file suspicious transaction reports (STRs) or covered transaction reports (CTRs) with the Anti-Money Laundering Council (AMLC) as required by RA 9160 (Anti-Money Laundering Act), as amended.
• To cooperate with lawful investigations by the National Bureau of Investigation (NBI), Philippine National Police (PNP), or other competent authorities.
• To respond to requests from the National Privacy Commission (NPC) in connection with data privacy complaints or investigations.

5.4 Business Transfers

In the event that if888 undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the new data controller's identity in accordance with the requirements of RA 10173.

6 Data Retention

if888 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, if888 will securely delete or anonymise the relevant personal data so that it can no longer be associated with you as an identifiable individual.

7 Data Security

7.1 Technical Measures

if888 implements a comprehensive set of technical security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include 256-bit SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data stored at rest, multi-factor authentication for access to internal systems that handle personal data, regular penetration testing and vulnerability assessments conducted by independent security professionals, and real-time intrusion detection and prevention systems.

7.2 Organisational Measures

In addition to technical controls, if888 maintains strict organisational policies to govern how personal data is accessed and handled internally. Access to personal data is granted on a strict need-to-know basis. All if888 staff who handle personal data are subject to confidentiality obligations and complete mandatory data privacy training. Third-party processors are subject to due diligence reviews before engagement and are bound by contractual data protection obligations.

7.3 Data Breach Response

In the event of a personal data breach that poses a real risk of serious harm to affected individuals, if888 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by NPC Circular No. 16-03. Affected data subjects will be notified without undue delay once the scope of the breach has been assessed and appropriate remediation measures are in place.

7.4 Your Responsibility

While if888 employs robust security measures on our end, the security of your account also depends on the steps you take to protect your login credentials. You are responsible for maintaining the confidentiality of your if888 username and password. Never share your credentials with anyone, including individuals claiming to be if888 staff. if888 will never ask you for your password through any communication channel.

8 Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work efficiently, to remember your preferences, and to provide information to website operators about how their site is being used. if888 uses cookies and similar tracking technologies including web beacons, pixel tags, and local storage objects.

8.2 Types of Cookies if888 Uses

• Strictly Necessary Cookies: These cookies are essential for the if888 platform to function. They enable core functions such as user authentication (keeping you logged in), security features, and session management. These cookies cannot be disabled without significantly affecting your use of the platform.
• Performance Cookies: These cookies collect aggregated, anonymised information about how players use the if888 platform — for example, which pages are visited most frequently and whether users encounter error messages. This data helps us improve the platform's performance and user experience.
• Functionality Cookies: These cookies allow the if888 platform to remember choices you have made — such as your language preference and game display settings — to provide a more personalised experience.
• Analytics Cookies: if888 uses analytics tools to understand player behaviour patterns, measure the effectiveness of platform features, and inform product development decisions. Analytics data is processed in aggregated, non-identifiable form wherever possible.
• Marketing Cookies: Where you have consented to receive marketing communications, if888 may use cookies to track the effectiveness of promotional campaigns and to avoid showing you the same promotional content repeatedly.

8.3 Managing Your Cookie Preferences

You can manage your cookie preferences through the if888 Cookie Preference Centre accessible in the platform settings, or by adjusting your browser settings to block or delete cookies. Please note that disabling strictly necessary cookies may prevent you from using certain features of the if888 platform. For more information on managing cookies in your specific browser, refer to your browser's help documentation.

9 Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by if888. We are committed to honouring these rights and responding to all valid requests within the timeframes prescribed by NPC regulations.

10 Protection of Minors

The if888 platform is strictly intended for use by individuals who are at least twenty-one (21) years of age, consistent with the minimum legal gambling age in the Philippines under PAGCOR regulations. if888 does not knowingly collect personal data from individuals under the age of 21.

All accounts are subject to age verification as part of the KYC process. Where if888 discovers or reasonably suspects that an account has been registered by or on behalf of a person under the age of 21, the account will be immediately suspended pending investigation. Any deposits made by a verified underage individual will be returned to the payment source. No winnings, bonuses, or other benefits will be disbursed in respect of any activity conducted by an underage person.

If you are a parent or guardian and you believe that a minor in your care has registered on the if888 platform, please contact our support team immediately at the email address provided in Section 13 so that we can take prompt action to close the account and protect the minor's data.

11 Cross-Border Data Transfers

The if888 platform primarily serves Filipino players and processes personal data within the Philippines. However, certain service providers engaged by if888 — including cloud hosting infrastructure, payment processing technology, and cybersecurity tools — may be located outside the Philippines, which may involve the transfer of personal data to other jurisdictions.

Where personal data is transferred outside the Philippines, if888 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required by RA 10173. These safeguards include contractual clauses in data processing agreements with overseas processors that impose equivalent data protection obligations, as required by NPC regulations governing cross-border data flows.

if888 does not transfer personal data to jurisdictions that are subject to international sanctions or that have been identified by the NPC as providing inadequate data protection without implementing additional compensating measures.

12 Changes to This Privacy Policy

if888 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, NPC guidance , regulatory requirements, or our data processing practices.

When we make material changes to this Privacy Policy, we will notify registered if888 players via email to the address on file and/or through a prominent notice on the if888 platform. The updated Privacy Policy will take effect from the date indicated in the "Effective Date" field at the top of this document. Your continued use of the if888 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how if888 protects your personal data. The most current version of this Privacy Policy is always available on the if888 platform at if888.app/privacy-policy.

13 Contact & Data Protection Officer Details

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which if888 processes your personal data, or if you wish to exercise any of the data subject rights described in Section 9, please contact the if888 Data Protection Officer using the details below:

When submitting a data subject rights request, please include your full name, registered email address, and a clear description of the right you wish to exercise or the concern you wish to raise. This will help us process your request promptly and accurately. For identity verification purposes, we may ask you to provide a copy of a valid government-issued ID before processing requests that involve access to or deletion of personal data.

If you are not satisfied with if888's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the competent data protection supervisory authority for the Philippines.