Privacy Policy

This Privacy Policy ("Policy") describes how sloph ("sloph," "we," "us," or "our"), the operator of the online casino and sports betting platform accessible at sloph.co, collects, uses, stores, and discloses the personal information of users ("you," "your," or "Player") who access or use the sloph platform.

sloph is committed to protecting the privacy and personal data of every Filipino player on its platform. This Policy is designed to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines, as well as applicable PAGCOR regulations governing online gambling operators.

By creating an account on sloph, depositing funds, or otherwise using the platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with the terms of this Policy, you should not use the sloph platform and should contact our support team to arrange account closure.

For the purposes of the Data Privacy Act of 2012, sloph acts as the Personal Information Controller (PIC) with respect to the personal data it collects from Players and visitors to sloph.co. This means sloph determines the purposes and means of processing your personal information.

Certain third-party service providers engaged by sloph (such as payment processors, game providers, and fraud detection services) act as Personal Information Processors (PIPs) and process data on behalf of sloph under contractual data processing agreements that require compliance with the Data Privacy Act and this Policy.

Contact details for the sloph Data Protection Officer (DPO) are provided in Section 16 of this Policy. The DPO is the designated point of contact for all privacy-related queries, data subject access requests, and complaints.

sloph collects the following categories of personal data, depending on how you use the platform:

sloph processes your personal data only where it has a lawful basis to do so. The following table sets out the primary purposes for which sloph processes personal data and the applicable legal basis under the Data Privacy Act of 2012:

sloph does not sell your personal data. We may share your data with the following categories of recipients, strictly to the extent necessary and under contractual data protection obligations:

• Payment Service Providers: GCash (operated by G-Xchange, Inc.), PayMaya (Voyager Innovations, Inc.), BPI, BDO, Metrobank, and other Philippine financial institutions processing your deposits and withdrawals. Data shared is limited to the transaction details required to complete the payment.
• KYC and Identity Verification Providers: Third-party identity verification agencies contracted by sloph to process government ID checks. These providers operate under strict data processing agreements requiring compliance with the Data Privacy Act.
• Game Technology Providers: Providers such as JILI Games may receive anonymised gameplay and session data for the purpose of game performance monitoring and certification audits. Personal identifying data is not shared with game providers.
• Fraud Prevention and Security Services: Third-party fraud detection and cybersecurity providers used to protect sloph's platform and player accounts. Data shared is limited to technical and transactional signals relevant to fraud risk.
• PAGCOR and Regulatory Authorities: sloph is required to disclose player account information to PAGCOR and other competent Philippine government agencies upon lawful request or as part of routine regulatory reporting obligations.
• Law Enforcement Authorities: Where required by applicable Philippine law, court order, or lawful government request, sloph will disclose personal data to law enforcement agencies. sloph will notify the relevant Player of any such disclosure where permitted by law.

sloph's primary data processing infrastructure is located within the Philippines. In certain limited circumstances — such as when international cloud infrastructure is used for platform operations or when third-party game technology providers operate servers in other countries — personal data may be transferred to jurisdictions outside the Philippines.

Where such transfers occur, sloph ensures that appropriate safeguards are in place in accordance with Section 21 of the Data Privacy Act, including contractual clauses that impose data protection standards equivalent to those required under Philippine law. sloph will not transfer personal data to a country that does not provide adequate data protection safeguards without implementing supplementary protective measures and obtaining the required approvals from the National Privacy Commission where applicable.

sloph retains personal data for the periods set out below, after which data is securely deleted or irreversibly anonymised:

• Account and Identity Data: Retained for the duration of your active account, plus a minimum of 5 years following account closure, to comply with PAGCOR record-keeping requirements and AML obligations under Republic Act No. 9160.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, as required by the Anti-Money Laundering Council (AMLC) regulations.
• KYC Document Data: Retained for a minimum of 5 years following account closure or the completion of the KYC process, whichever is later.
• Gameplay History: Retained for the duration of the account, plus 2 years after account closure, for dispute resolution and audit purposes.
• Customer Support Communications: Retained for 3 years from the date of the communication, for quality assurance and dispute resolution.
• Marketing Preferences Data: Retained until you withdraw consent for marketing communications, or until your account is closed, whichever is earlier.
• Technical / Log Data: Retained for a maximum of 13 months from the date of collection, unless a longer period is required for a specific fraud investigation or security incident.

sloph implements a multi-layered security framework to protect your personal data from unauthorized access, disclosure, alteration, and destruction. Security measures in place include:

• Encryption in transit: All data transmitted between your browser or mobile device and sloph's servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Personal data stored in sloph's databases is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis and requires multi-factor authentication for all administrative personnel.
• Two-factor authentication (2FA): Players may enable SMS-based 2FA for their sloph accounts to provide an additional layer of account security against unauthorized login.
• Intrusion detection and monitoring: sloph's infrastructure is monitored 24/7 for anomalous access patterns, intrusion attempts, and denial-of-service activity.
• Regular penetration testing: sloph engages independent cybersecurity specialists to conduct periodic penetration tests of the platform's infrastructure and applications.
• Vulnerability management: sloph maintains a structured patch management process to address security vulnerabilities in its technology stack in a timely manner.

Under the Data Privacy Act of 2012, as a Filipino data subject, you have the following rights with respect to your personal data held by sloph:

To exercise any of these rights, please contact sloph's Data Protection Officer at the contact details provided in Section 16. sloph will respond to all verified data subject requests within 30 calendar days of receipt. Complex requests may require up to an additional 30 days, in which case sloph will notify you of the extended timeline.

During account registration, sloph requires users to confirm their date of birth and collects identity documents as part of the KYC process that verifies age. Where sloph becomes aware that personal data has been collected from an individual under 21 years of age, it will immediately close the associated account, delete all personal data related to that account to the extent permitted by applicable law, and return any funds deposited.

If you believe that a minor has created an account on sloph or that sloph has inadvertently collected data from a minor, please contact our Data Protection Officer immediately using the details in Section 16.

With your consent, sloph may send you promotional communications relating to bonuses, new game releases, special offers, and responsible gaming reminders. These may be delivered via SMS to your registered Philippine mobile number, by email to your registered address, or via in-platform notification.

You may withdraw your consent for marketing communications at any time by:

• Updating your notification preferences in the sloph Account settings;
• Clicking the unsubscribe link included in any marketing email from sloph;
• Sending a request to sloph's customer support team via live chat or email.

Withdrawal of marketing consent does not affect your ability to use the sloph platform, and sloph will continue to send you essential service communications (such as account security alerts, withdrawal confirmations, and KYC requests) regardless of your marketing preferences, as these are necessary for the performance of your account agreement with sloph.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, sloph will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03 on Security of Personal Data in Government Agencies.

Where a breach is likely to result in a high risk to your rights, sloph will also notify affected Players directly without undue delay. The notification will include: the nature of the breach, the categories of data affected, the likely consequences of the breach, and the measures sloph has taken or is taking to address it.

sloph maintains a documented data breach response plan and incident management procedures. The sloph security team conducts post-breach reviews to identify root causes and implement corrective measures to prevent recurrence.

sloph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

Material changes to this Policy — those that significantly affect how sloph processes your personal data or your privacy rights — will be communicated to registered Players by email to their registered address and via an in-platform notification at least 14 days before the change takes effect. Non-material changes (such as typographical corrections, clarifications of existing practices, or restructuring without substantive change) may be made without advance notice.

Continued use of the sloph platform following the effective date of a Policy revision constitutes acceptance of the updated Policy. If you do not agree with any revision, you should close your account before the revision takes effect.

sloph has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO is the first point of contact for all data privacy matters, including data subject access requests, complaints, and inquiries.

You may contact sloph's Data Protection Officer and privacy support team through the following channels:

• Live Chat: Available 24/7 within the sloph platform after login — the fastest channel for urgent privacy concerns.
• Email: [email protected] — please include "Privacy Request" or "DPO" in the subject line for routing to the correct team.

When submitting a data subject rights request, please include your full name, registered email address or mobile number, the specific right you wish to exercise, and any relevant details to assist with identification and processing. sloph may require identity verification before processing certain requests to protect against unauthorized access.