xxhp Privacy Policy

The personal information controller responsible for the processing of your data in connection with the xxhp platform is xxhp, operating xxhp.asia. All enquiries relating to data privacy, rights requests, and complaints should be directed to the xxhp Data Protection Officer (DPO), contact details for whom are provided in Section 14 of this policy.

xxhp is registered with the National Privacy Commission of the Philippines in accordance with NPC Registration Circular No. 17-01. The Company processes personal data in its capacity as both a personal information controller (for data it collects directly) and, where applicable, a personal information processor (where it processes data on behalf of its licensed game suppliers in the course of providing player account services).

xxhp collects the following categories of personal data from players and prospective players of the Platform:

2.1 Identity & Contact Data

• Full legal name as it appears on a Philippine government-issued identification document;
• Date of birth;
• Residential address (including barangay, city/municipality, province);
• Valid Philippine mobile number (Globe, Smart, DITO, or other registered carrier);
• Email address.

2.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued identification documents (e.g., Philippine passport, SSS/UMID card, driver's license, PhilHealth ID, Voter's ID);
• Proof of residential address documents (e.g., utility bills, bank statements, official government correspondence);
• Selfie or live photograph where required for liveness verification;
• Source of funds documentation where triggered by AML thresholds.

2.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers;
• GCash account reference numbers, PayMaya account references, or bank account details (BPI, BDO, Metrobank) submitted for withdrawal processing;
• USDT wallet addresses where applicable;
• Betting history, game session data, and wagering records.

2.4 Technical & Usage Data

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser type;
• Session duration, pages visited, and navigation patterns on the Platform;
• Login timestamps and device fingerprint data used for fraud detection.

2.5 Communications Data

• Records of live chat support interactions, including chat transcripts;
• Email correspondence with the xxhp support team;
• Responses to player satisfaction surveys where voluntarily submitted.

xxhp collects personal data through the following channels:

• Account Registration: Data you provide directly when creating your xxhp account, including your name, mobile number, email address, and date of birth;
• KYC Submission: Documents and images you upload through the xxhp identity verification interface when completing Know Your Customer requirements;
• Payment Transactions: Financial details processed when you deposit or withdraw funds using GCash, PayMaya, BPI, BDO, Metrobank, or USDT;
• Platform Usage: Technical data collected automatically as you navigate and use the xxhp platform, including through cookies and similar tracking technologies (see Section 7);
• Customer Support: Information shared during live chat sessions or email correspondence with the xxhp support team;
• Third-Party Providers: Data received from KYC verification service providers, fraud detection services, and payment processors where necessary to fulfil compliance obligations.

xxhp processes your personal data only for the specific, legitimate purposes set out below. Each processing activity is grounded in one or more legal bases recognized under RA 10173:

xxhp does not sell your personal data. We share your data only where strictly necessary and with the following categories of recipients, all of whom are bound by data processing agreements or equivalent contractual protections:

• Licensed Game Suppliers: Providers such as JILI, Pragmatic Play, and PG Soft receive the minimum data necessary to authenticate your session and record game outcomes. These providers are independently licensed and subject to their own data protection obligations;
• Payment Processors: GCash (G-Xchange Inc.), PayMaya Philippines Inc., and banking partners (BPI, BDO, Metrobank) receive transactional data necessary to process deposits and withdrawals;
• KYC Verification Services: Third-party identity verification providers process your submitted KYC documents solely for the purpose of age and identity verification under xxhp's instruction;
• Fraud Prevention Services: Anti-fraud and device fingerprinting service providers receive technical data to assist in detecting and preventing unauthorized account access;
• PAGCOR: The Philippine Amusement and Gaming Corporation may receive player data as required under xxhp's licensing conditions and applicable Philippine gambling regulations;
• AMLC: The Anti-Money Laundering Council may receive transaction reports and player data as required under the Anti-Money Laundering Act (RA 9160) and xxhp's AML compliance obligations;
• National Privacy Commission: In the event of a reportable personal data breach, xxhp is obligated to notify the NPC and affected data subjects as required under RA 10173;
• Legal & Regulatory Authorities: Philippine law enforcement or courts where disclosure is required pursuant to a valid legal order, subpoena, or warrant.

Some of xxhp's third-party service providers — including game suppliers and KYC verification services — may be located outside of the Philippines. Where personal data is transferred to a recipient in a jurisdiction other than the Philippines, xxhp ensures that adequate safeguards are in place to protect your data in accordance with RA 10173.

Safeguards for international transfers include:

• Standard contractual clauses (SCCs) approved by or consistent with NPC guidance;
• Transfer to recipients in jurisdictions recognized by the NPC as providing adequate data protection;
• Binding corporate rules where transfers occur within an affiliated group of entities;
• Explicit consent where required and none of the above safeguards is applicable.

In all cases, xxhp remains responsible for ensuring that your data receives the same standard of protection as it would under Philippine law, regardless of where it is processed.

xxhp uses cookies and similar technologies on the Platform to deliver core functionality, enhance your experience, and gather analytics that help us improve the service. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect the functionality of the xxhp platform — in particular, your ability to maintain a logged-in session.

xxhp retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law, whichever is longer. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your active account relationship with xxhp, plus a minimum of five (5) years following account closure. This retention period reflects xxhp's AML obligations under RA 9160;
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or from the date of the last transaction associated with the verified account, whichever is later;
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with PAGCOR reporting requirements and AMLC record-keeping obligations;
• Customer Support Records: Retained for three (3) years from the date of the support interaction, for dispute resolution and quality assurance purposes;
• Technical & Usage Data: Retained for up to twenty-four (24) months from the date of collection, after which it is anonymized or deleted;
• Marketing Consent Records: Retained for the duration of your consent and for three (3) years following withdrawal of consent, to demonstrate compliance.

Where retention beyond these periods is required by a court order, ongoing regulatory investigation, or other legal proceeding, data will be retained until the relevant matter is resolved.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by xxhp. You may exercise any of these rights by contacting the xxhp Data Protection Officer (see Section 14):

If you are a parent or guardian and believe your child may have created an xxhp account, please contact our support team immediately via live chat. xxhp's identity verification procedures are designed to detect underage registrations; however, we rely on the cooperation of adults to ensure that minors do not gain access to devices or credentials associated with an xxhp account.

xxhp implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and xxhp's servers is encrypted using TLS 1.2 or higher (256-bit SSL). No unencrypted personal data is transmitted over public networks;
• Encryption at Rest: Personal data stored in xxhp's databases is encrypted using AES-256 encryption. KYC documents are subject to enhanced encryption with restricted key access;
• Access Controls: Access to personal data within the xxhp organization is restricted to authorized personnel on a strict need-to-know basis. All employees with access to personal data are subject to confidentiality obligations and regular data protection training;
• Two-Factor Authentication: Player accounts are protected by OTP-based two-factor authentication on new device logins. Internal xxhp systems use hardware-based MFA for all staff with access to player data;
• Security Monitoring: xxhp operates 24/7 security monitoring for its platforms and data infrastructure. Anomalous access patterns trigger automated alerts and incident response procedures;
• Penetration Testing: xxhp's platforms undergo regular independent security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited;
• Data Minimization: Production systems handle only the minimum personal data required for the relevant function. Test environments do not use real player data.

Despite these measures, no information transmission over the internet or electronic storage system is 100% secure. xxhp cannot guarantee absolute security, and players bear responsibility for maintaining the security of their own xxhp login credentials.

With your consent, xxhp may send you marketing communications about new games, promotions, bonuses, and platform features via SMS, email, or push notification to your registered Philippine mobile number or email address. Consent for marketing communications is collected separately from the general Terms & Conditions at the point of registration and can be managed through your xxhp account settings.

You may withdraw consent for marketing communications at any time by:

• Updating your notification preferences in the xxhp account settings dashboard;
• Clicking the unsubscribe link included in any xxhp marketing email;
• Contacting xxhp support via live chat and requesting removal from marketing lists.

Withdrawing consent for marketing communications will not affect your ability to use the xxhp platform or your receipt of transactional communications (such as deposit confirmations, withdrawal processing updates, and security alerts), which are sent on the basis of contract performance and cannot be opted out of while your account remains active.

xxhp reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidance, or our data processing practices. When material changes are made, xxhp will provide notice by updating the "Last Updated" date at the top of this page and, where the changes significantly affect your rights, by sending a notification to your registered email address or via a notice on the xxhp platform.

We encourage you to review this Privacy Policy periodically to remain informed about how xxhp protects your personal data. Your continued use of the xxhp platform following the publication of an updated Privacy Policy constitutes acceptance of the revised terms, to the extent permitted by RA 10173.

Where a proposed change to this policy would require a new or different form of consent under RA 10173, xxhp will seek that consent from you explicitly before the change takes effect in respect of your personal data.

xxhp has appointed a Data Protection Officer (DPO) in accordance with Section 21 of RA 10173 and NPC Circular 17-01. The DPO is responsible for overseeing xxhp's data protection compliance programme, responding to rights requests, and acting as the primary point of contact with the National Privacy Commission.

To exercise your data rights, report a potential data breach, or raise a privacy concern regarding the xxhp platform, please contact us using the following channels:

• Live Chat: Available 24/7 via the xxhp platform — the fastest route for urgent privacy concerns. Filipino-speaking agents are available throughout peak evening hours for players in Manila, Cebu, Davao, and across the Philippines;
• DPO Email: [email protected] (plain text — this is not a clickable link);
• General Support Email: [email protected] (plain text — not a clickable link).

xxhp will acknowledge all privacy-related enquiries within 2 business days and will provide a full response within 15 business days, as required under RA 10173.