Privacy Policy

palago ("palago", "we", "us", "our") operates the online gaming platform accessible at palago.one, including all associated mobile applications, subdomains, and services. palago is committed to protecting the privacy and personal data of every player and visitor who interacts with our platform.

This Privacy Policy ("Policy") describes what personal data palago collects, why we collect it, how we use and protect it, with whom we may share it, and what rights you have with respect to your personal data. It applies to all palago users, including registered account holders, visitors browsing without an account, and individuals who contact palago support.

By creating a palago account, depositing funds, playing any game, or simply visiting palago.one, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must discontinue use of the palago platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, palago acts as the Personal Information Controller (PIC) in respect of the personal data processed through the palago platform. palago determines the purposes and means of processing personal data collected from users of palago.one and its associated services.

palago has appointed a Data Protection Officer (DPO) who can be reached via the contact details provided in Section 13 of this Policy. The DPO is responsible for overseeing palago's data protection compliance programme and serves as the primary point of contact for data subjects wishing to exercise their rights.

palago collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and in some cases from third parties such as payment processors and identity verification services.

palago does not collect sensitive personal information as defined under the Data Privacy Act (e.g., health data, religious beliefs, political affiliation) unless specifically required by regulatory obligations such as problem gambling assessment processes.

palago uses personal data for the following purposes:

• Account management: Creating and maintaining your palago account, verifying your identity, and providing access to platform features.
• Transaction processing: Processing GCash and other Philippine payment method deposits and withdrawals, preventing duplicate transactions, and maintaining financial records.
• Legal and regulatory compliance: Fulfilling palago's obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012, including KYC and AML record-keeping requirements.
• Responsible gaming: Monitoring gaming behaviour to identify signs of problem gambling, enforcing self-exclusion requests, and applying player-set deposit and session limits.
• Security and fraud prevention: Detecting unauthorized access, preventing bonus abuse, identifying suspicious financial transactions, and protecting the integrity of the platform.
• Customer support: Responding to queries, resolving disputes, and processing complaints submitted by palago players.
• Platform improvement: Analysing aggregated, anonymized usage data to improve palago's game library, user interface, and overall platform performance.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time via your account settings.

palago processes personal data on the following legal grounds under the Data Privacy Act of 2012:

• Contract performance: Processing necessary to fulfil the palago Terms & Conditions you agreed to at registration, including account management and payment processing.
• Legal obligation: Processing required to comply with PAGCOR regulations, AMLA obligations, tax reporting requirements, and other applicable Philippine law.
• Legitimate interests: Processing for fraud detection, platform security, and aggregated analytics, where such interests are not overridden by your fundamental rights.
• Consent: Processing for direct marketing communications, where you have provided explicit, informed, and freely given consent that you may withdraw at any time.

palago does not sell, rent, or trade your personal data to third parties for their own marketing purposes. palago may share your data with the following categories of recipients, strictly limited to the purpose for which the data is shared:

• Payment processors: GCash, PayMaya, BDO, BPI, Metrobank, and other Philippine payment service providers, solely for processing deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML screening services used to verify player identity and comply with regulatory requirements.
• Game software providers: Licensed game studios whose products are offered on the palago platform, where technical integration requires limited data exchange.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies where disclosure is required by law or court order.
• IT infrastructure providers: Cloud hosting and data storage providers operating under data processing agreements that require them to protect your data to the same standard as palago.

All third-party data processors engaged by palago are bound by contractual data processing agreements that require them to implement appropriate security measures and restrict use of your data to the specified purpose only.

palago uses cookies and similar tracking technologies on the palago.one website and within the platform. Cookies are small text files stored on your device that help palago deliver a personalized, secure, and functional experience.

Essential cookies are strictly necessary for platform operation, including session management and security tokens. These cannot be disabled without affecting core functionality.

Analytics cookies collect anonymized data about how players navigate and interact with palago, helping us identify performance issues and improve the platform. These are only activated with your consent.

Preference cookies remember your platform settings, language preferences, and last-visited game categories to streamline your palago experience across sessions.

You may manage or withdraw consent for non-essential cookies through your device browser settings or via the palago cookie preference centre. Note that disabling certain cookies may affect your ability to use some platform features.

palago retains personal data for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable Philippine law and regulation. Specific retention periods include:

• Account data: Retained for the duration of your active palago account plus a minimum of 5 years following account closure, as required for AML and regulatory record-keeping.
• Transaction records: Retained for a minimum of 5 years in compliance with AMLA record-keeping requirements.
• KYC documents: Retained for 5 years following the end of the business relationship, in accordance with PAGCOR and AMLC requirements.
• Support communications: Retained for 2 years following resolution of the relevant issue.
• Marketing data: Retained until you withdraw consent or request deletion, subject to overriding legal obligations.

When personal data is no longer required, palago will securely delete or anonymize it in accordance with industry best practices.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by palago:

• Right to be informed: The right to know what personal data palago collects and how it is processed — as set out in this Policy.
• Right of access: The right to request a copy of the personal data palago holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data in your palago account.
• Right to erasure: The right to request deletion of your personal data, subject to palago's legal and regulatory retention obligations.
• Right to object: The right to object to palago's processing of your personal data for direct marketing at any time, and to object to processing based on legitimate interests where you have grounds relating to your particular situation.
• Right to data portability: The right to receive a copy of personal data you have provided to palago in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe palago has violated your data privacy rights.

To exercise any of these rights, contact palago's Data Protection Officer using the details in Section 13. palago will respond to all data subject requests within 30 calendar days.

palago implements a comprehensive range of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the palago platform.
• Encrypted storage of passwords using industry-standard hashing algorithms — palago never stores plain-text passwords.
• Segregated database environments with strict role-based access controls limiting internal access to personal data on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments conducted by independent third-party security firms.
• Two-factor authentication available to all palago account holders as an additional login security layer.
• Incident response procedures for detecting, containing, and notifying affected users and the NPC of any personal data breach within the timeframes required by law.

While palago takes every reasonable precaution to protect your data, no online platform can guarantee absolute security. You are encouraged to use a strong, unique password for your palago account and to enable two-factor authentication.

The palago platform is strictly intended for individuals who are 21 years of age or older. palago does not knowingly collect personal data from individuals under 21. If palago becomes aware that personal data has been collected from a minor, it will be deleted immediately and the relevant account will be closed.

If you are a parent or guardian and believe that a minor has registered an account or provided personal data to palago, please contact our Data Protection Officer immediately at the details provided in Section 13.

palago reserves the right to update or amend this Privacy Policy at any time. Material changes that affect how palago collects or uses personal data will be communicated to registered players via the email address or mobile number on file at least 7 days before taking effect, except where immediate changes are required by law.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the palago platform after the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must cease using the platform and may request account closure.

For questions, data subject access requests, or concerns about palago's data privacy practices, please contact: