638club Privacy Policy

638club is committed to protecting the privacy and personal data of all individuals who interact with our Platform — whether you are a registered Member placing bets in our JILI slots or live baccarat tables, a visitor browsing our promotional pages, or a customer contacting our support team from anywhere in the Philippines, from Metro Manila to Cebu, Davao, Bacolod, or Cagayan de Oro.

This Policy is written in compliance with the Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. It also reflects the data-handling obligations placed on 638club as a PAGCOR-licensed online gaming operator, including Anti-Money Laundering Act (AMLA) compliance and Know Your Customer (KYC) requirements under BSP and AMLC guidelines.

For the purposes of the Data Privacy Act of 2012, 638club is the Personal Information Controller (PIC) in respect of all personal data collected through the 638club Platform. As the PIC, 638club determines the purposes and means of processing your personal information and is responsible for ensuring that processing is carried out in accordance with RA 10173 and applicable PAGCOR regulatory requirements.

638club has designated a Data Protection Officer (DPO) who is responsible for overseeing data privacy compliance, handling data subject access requests, and serving as the primary contact point for the National Privacy Commission. The DPO can be reached at [email protected] with the subject line "Data Privacy — DPO."

638club collects the following categories of personal data from Members and Platform users:

• Full legal name as it appears on a Philippine government-issued ID;
• Date of birth (to verify that you are at least 21 years of age);
• Gender;
• Government-issued photo ID details (PhilSys, passport, UMID, or driver's license number and expiry);
• Selfie photograph submitted for identity verification.

• Philippine mobile number (the primary identifier for your 638club Account);
• Email address (where provided for account recovery or communications);
• Physical address (where required for KYC verification purposes).

• GCash account number and registered name;
• Maya (PayMaya) account details;
• Bank account name, account number, and bank name (BPI, BDO, Metrobank, etc.) where provided for bank transfer transactions;
• Transaction histories including deposit amounts, withdrawal amounts, dates, and reference numbers.

• Game session logs including game name, duration, stake amounts, results, and timestamps;
• Betting history across all 638club products (slots, live casino, sports, bingo, sabong, crash);
• Account balance history;
• Bonus usage and wagering requirement progress;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status).

• IP address and geolocation data;
• Device type, operating system, and browser information;
• Session identifiers, login timestamps, and device fingerprint data;
• Cookies and similar tracking technology data (see Section 8).

• Records of all interactions with 638club customer support via live chat, email, or SMS;
• Content of complaints, feedback, or queries submitted to 638club.

638club collects personal data through the following channels and methods:

• Direct registration: Data you provide when creating your 638club Account, including mobile number, date of birth, and password;
• KYC verification: Identity documents and selfie photographs uploaded during the verification process;
• Deposits and withdrawals: Payment details collected when you make transactions via GCash, Maya, or bank transfer;
• Platform usage: Game session data, betting activity, and account interactions recorded automatically as you use the 638club Platform;
• Customer support: Information you provide when contacting our support team via live chat or email;
• Automated technologies: Cookies, session tokens, IP logging, and device fingerprinting tools that operate when you visit or interact with the Platform (see Section 8);
• Third-party providers: Identity verification providers, payment processors (GCash, Maya), and fraud detection services may share data with 638club as part of our onboarding and transaction monitoring processes.

638club processes personal data for the following specific, legitimate purposes:

Under the Data Privacy Act of 2012, 638club processes personal data on the following legal grounds:

• Consent (Section 12[a], RA 10173): Where you have given explicit, freely-given, specific, and informed consent — for example, subscribing to promotional communications;
• Contract Performance (Section 12[b], RA 10173): Where processing is necessary to fulfill our contractual obligations to you as a 638club Member, including account management, game provision, and payment processing;
• Legal Obligation (Section 12[c], RA 10173): Where processing is required to comply with applicable law, including PAGCOR licensing conditions, AMLA obligations, NPC registration requirements, and BSP-regulated payment processing rules;
• Legitimate Interests (Section 12[f], RA 10173): Where processing is necessary to pursue the legitimate interests of 638club, including fraud prevention, platform security, and responsible gaming monitoring, provided these interests do not override your fundamental rights and freedoms.

638club does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share personal data only in the following circumstances:

• PAGCOR: As a licensed operator, 638club is required to submit gaming activity reports, player registration data, and suspicious activity reports to PAGCOR in accordance with our licensing conditions;
• Anti-Money Laundering Council (AMLC): Covered transaction reports and suspicious transaction reports as required under the Anti-Money Laundering Act;
• National Privacy Commission (NPC): In the event of a personal data breach, or in response to lawful NPC orders;
• Law enforcement authorities: In response to a lawful court order, subpoena, or formal request from a Philippine law enforcement authority with proper jurisdiction.

638club engages trusted third-party service providers who process personal data on our behalf as Personal Information Processors (PIPs) under written data processing agreements that comply with RA 10173. These include:

• Payment processors: GCash (GXchange Inc.), Maya (PayMaya Philippines Inc.), and partner banks;
• KYC and identity verification technology providers;
• Cloud infrastructure and data hosting providers;
• Fraud detection and security monitoring services;
• Customer support platform providers;
• Game content providers (including JILI and live dealer studios) who receive only the minimum session data required to operate their games.

All PIPs engaged by 638club are contractually obligated to process data only as instructed by 638club, to maintain appropriate security standards, and to comply with RA 10173.

638club uses cookies and similar tracking technologies to operate the Platform, maintain your login session, remember your preferences, analyze usage patterns, and prevent fraud. The following types of cookies are used:

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that keep you logged in to your 638club Account during an active session. These cookies cannot be disabled without affecting core Platform functionality;
• Security Cookies: Used for fraud prevention, anti-bot protection, and detecting unauthorized access attempts. These are necessary for account and platform security;
• Preference Cookies: Remember your language preferences and other display settings to improve your experience on the 638club Platform;
• Analytics Cookies: Used to understand how Members use the Platform, which pages they visit most often, and how they navigate between sections. Data collected is aggregated and anonymized where possible;
• Marketing Cookies (Opt-in only): Used to deliver relevant promotional content. These cookies are only active for Members who have opted in to marketing communications.

You may manage cookie preferences through your browser settings. Disabling essential cookies may impair your ability to log in or use core 638club Platform features.

638club retains personal data for the periods set out below, or for longer where required by law:

• Active Account Data: Retained for the duration of your 638club Account and for a minimum of five (5) years following permanent account closure, as required by PAGCOR licensing conditions and AMLA record-keeping obligations;
• KYC and Identity Verification Data: Retained for a minimum of five (5) years following the last transaction or account closure, as required under AMLA regulations;
• Transaction Records (Deposits and Withdrawals): Retained for a minimum of five (5) years from the transaction date in accordance with BSP payment system record-keeping requirements;
• Gaming Activity Logs: Retained for a minimum of three (3) years or longer if required by an ongoing investigation or dispute;
• Customer Support Communications: Retained for a minimum of two (2) years from the date of the last communication;
• Marketing Consent Records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of the original consent.

Upon expiry of applicable retention periods, 638club will securely destroy or permanently anonymize personal data such that it can no longer be attributed to an identifiable individual.

638club implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data transmitted between your device and the 638club Platform is protected by 256-bit SSL/TLS encryption. Sensitive data including passwords and financial information is encrypted at rest;
• Access Controls: Access to personal data within 638club's systems is restricted to authorized personnel on a strict need-to-know basis, with role-based access controls and audit logging;
• Two-Factor Authentication: 638club offers SMS-based two-factor authentication for Member accounts and enforces multi-factor authentication for internal staff with access to data systems;
• Network Security: Firewalls, intrusion detection systems, and regular penetration testing protect the 638club Platform infrastructure;
• Data Breach Response: 638club maintains a documented personal data breach response procedure. In the event of a breach likely to result in risk to your rights and freedoms, 638club will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected Members without undue delay where required under RA 10173.

Notwithstanding these measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your 638club login credentials and for using a secure network when accessing the Platform.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by 638club. These rights may be exercised by contacting our Data Protection Officer at [email protected]:

638club will respond to all data subject requests within thirty (30) days of receipt. Where a request is complex or involves a high volume of data, we may extend this period by a further thirty (30) days with notification to the requestor. Where we are unable to comply with a request due to legal obligations (such as AMLA retention requirements), we will explain the reason clearly.

The 638club Platform is strictly intended for adults who are twenty-one (21) years of age or older, as required by PAGCOR regulations and Philippine gaming law. 638club does not knowingly collect personal data from individuals under 21 years of age.

If 638club becomes aware that personal data has been collected from a person under 21 years of age, that data will be deleted immediately and the associated Account will be permanently closed. If you believe a person under 21 has registered a 638club Account, please contact our Data Protection Officer immediately at [email protected].

The 638club Platform may display links or references to third-party services such as GCash, Maya, and game provider interfaces. 638club is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service you use in connection with your 638club Account, including GCash (GXchange Inc.) and Maya (PayMaya Philippines Inc.), as these services operate under their own privacy frameworks.

Game content on the 638club Platform is provided by third-party game studios including JILI. These providers may receive session-level data (such as game round identifiers and bet amounts) necessary to operate and display game results. They do not receive personally identifiable information beyond what is strictly required for game operation and are bound by data processing agreements consistent with RA 10173.

638club reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. All updates will be published on this page with a revised Effective Date.

Where changes to this Policy are material — including changes that significantly affect how we use your personal data or your rights under RA 10173 — 638club will provide advance notice via a prominent notification on the Platform or by SMS to your registered Philippine mobile number at least seven (7) days before the changes take effect.

Your continued use of the 638club Platform following the publication of a revised Privacy Policy constitutes your acknowledgment of the changes and, where applicable, your consent to the revised processing described therein.

If you have questions about this Privacy Policy, wish to exercise any of your data subject rights, or have concerns about how 638club handles your personal data, please contact us:

• Data Protection Officer (DPO): [email protected] — Subject: "Data Privacy — DPO"
• General Customer Support: Live Chat on the 638club Platform, available 24/7
• General Email: [email protected]

If you are not satisfied with 638club's response to a data privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines through their official government channels. The NPC is the independent authority responsible for administering and enforcing RA 10173 in the Philippines.