Privacy Policy —
hand777 Online Casino

Overview & Scope

This Privacy Policy ("Policy") applies to all personal information collected, processed, stored, and shared by hand777 in connection with the operation of the hand777 online gaming Platform accessible at hand777.app ("the Platform"). It covers personal data collected from registered players, prospective players who initiate but do not complete registration, and visitors who interact with the Platform without creating an account.

This Policy should be read in conjunction with the hand777 Terms and Conditions, which govern the overall contractual relationship between hand777 and its players. Where this Policy and the Terms and Conditions address the same subject matter, this Policy shall prevail with respect to data privacy matters.

This Policy does not apply to third-party websites, payment processors, or game providers that may be linked from or integrated into the Platform. Those entities maintain their own data privacy policies, and hand777 is not responsible for their data handling practices.

Data Controller

For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations, hand777 is the Personal Information Controller with respect to the personal data of players and Platform users. hand777 determines the purposes and means of processing personal data collected through the Platform.

hand777 has appointed a Data Privacy Officer (DPO) responsible for overseeing compliance with data privacy obligations, handling data subject requests, and serving as the point of contact with the National Privacy Commission. The DPO's contact details are provided in Section 17 of this Policy.

Data We Collect

hand777 collects the following categories of personal information in connection with the operation of the Platform:

hand777 does not collect sensitive personal information — such as health data, religious beliefs, or political affiliations — except where a player voluntarily discloses health or wellbeing information in the context of a responsible gaming interaction, in which case it is used solely for the player protection purpose for which it was shared.

How Data Is Collected

hand777 collects personal data through the following channels:

• Account Registration: Data provided directly by you when creating a hand777 account, including mobile number, email, name, and date of birth.
• KYC Submission: Identity documents and verification selfies uploaded through the account verification workflow.
• Deposits and Withdrawals: Financial identifiers received from GCash, Maya, and banking partners when transactions are processed.
• Platform Usage: Technical and gaming data collected automatically while you use the hand777 Platform, including via cookies and server logs.
• Support Interactions: Information you provide when contacting hand777 customer support via live chat or email.
• Responsible Gaming Tools: Data generated when you activate deposit limits, session controls, or self-exclusion features.
• Third-Party Verification: Identity verification data returned by approved KYC service providers who cross-reference documents against government databases.

Purposes of Processing

hand777 processes personal data for the following lawful purposes:

5.1 Platform Operation

To create and maintain player accounts, authenticate logins, process deposits and withdrawals, deliver game services, operate the hand777 VIP loyalty programme, and provide customer support. This processing is necessary for the performance of the player's contract with hand777.

5.2 Regulatory Compliance

To fulfil hand777's obligations as a PAGCOR-licensed operator, including mandatory player identity verification (KYC), age verification, transaction monitoring under the Anti-Money Laundering Act (AMLA), suspicious transaction reporting to the Anti-Money Laundering Council (AMLC), and periodic reporting to PAGCOR. This processing is required by law and cannot be waived by the player.

5.3 Fraud Prevention and Security

To detect, investigate, and prevent fraudulent activity, account takeovers, collusion between players, bonus abuse, and other breaches of the hand777 Terms and Conditions. This processing is based on hand777's legitimate interest in maintaining a secure and fair gaming environment.

5.4 Responsible Gaming

To monitor player activity for indicators of problem gambling, to enforce limits and restrictions activated by the player, to process self-exclusion requests, and to comply with PAGCOR responsible gaming requirements. This processing serves both a contractual obligation and a legitimate interest in player welfare.

5.5 Marketing Communications

To send promotional offers, bonus notifications, and platform updates to players who have provided explicit consent to receive such communications. Consent is recorded at the point of registration or preference update and may be withdrawn at any time. Withdrawal of marketing consent does not affect the validity of any processing carried out prior to withdrawal.

5.6 Service Improvement

To analyse aggregated and anonymised usage data to improve Platform performance, user experience, game selection, and payment processing efficiency. Where possible, hand777 uses anonymised or pseudonymised data for analytical purposes to minimise privacy impact.

Lawful Basis for Processing

Under the Data Privacy Act of 2012, hand777 processes personal data on the following lawful bases:

• Contractual Necessity: Processing required to open and manage a player account, process financial transactions, and deliver gaming services in accordance with the hand777 Terms and Conditions.
• Legal Obligation: Processing required by Philippine law, including PAGCOR licensing conditions, AMLA obligations, and NPC data subject notification requirements.
• Legitimate Interest: Processing for fraud prevention, platform security, and service improvement, where hand777's interests do not override the player's fundamental privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where explicit, freely given, specific, and informed consent has been obtained and recorded.

Data Sharing

hand777 does not sell, rent, or commercially trade personal data. Personal information is shared only in the following circumstances and only to the extent necessary for the stated purpose:

7.1 Payment Processors

Financial transaction data — including mobile wallet identifiers and transaction amounts — is shared with GCash, Maya, and banking partners to process deposits and withdrawals. These entities act as independent data controllers with respect to the data they process under their own terms.

7.2 KYC and Identity Verification Providers

Identity documents submitted for KYC verification are shared with hand777's approved identity verification service providers, who may cross-reference documents against government databases. These providers process data under data processing agreements with hand777 and are bound by confidentiality obligations.

7.3 Regulatory Authorities

hand777 is required by law to share player identity and transaction data with PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC) upon lawful demand. hand777 will not disclose personal data to government agencies outside of a lawful order, warrant, or regulatory obligation.

7.4 Game Content Providers

Certain game providers — particularly live casino providers — receive limited session and wagering data for the purpose of operating their games. This data is processed under contractual data processing agreements and is limited to what is technically required to deliver the game service.

7.5 Fraud Prevention Networks

Where hand777 has reasonable grounds to suspect fraud, account takeover, or money laundering activity, it may share relevant player identifiers with industry fraud prevention networks or law enforcement as permitted or required by law.

International Data Transfers

Certain technology vendors and game content providers used by hand777 may process data on servers located outside the Philippines. Where personal data is transferred internationally, hand777 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses or equivalent data transfer mechanisms;
• Transfers to jurisdictions determined by the National Privacy Commission to offer an adequate level of data protection; or
• Specific consent from the data subject where required.

Players may contact the hand777 DPO (Section 17) to obtain further information about the specific safeguards in place for any international transfer of their personal data.

Data Retention

hand777 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, taking into account applicable legal retention requirements. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. Where technical constraints prevent immediate deletion, data is isolated from active processing systems pending scheduled deletion.

Security Measures

hand777 implements organisational and technical security measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Key security controls include:

• Encryption in Transit: All data transmitted between the player's browser or device and hand777 servers is encrypted using TLS 1.2 or higher (256-bit SSL), the same encryption standard used by Philippine commercial banks.
• Encryption at Rest: Sensitive personal data — including KYC documents, financial identifiers, and government ID numbers — is encrypted at rest using AES-256 encryption on hand777's secure cloud infrastructure.
• Access Controls: Access to player personal data is restricted to hand777 personnel and authorised third parties who require it for legitimate purposes. Role-based access controls ensure that employees can only access data relevant to their specific function.
• Multi-Factor Authentication: Internal systems holding personal data require multi-factor authentication for all administrative access.
• Penetration Testing: hand777's Platform and data infrastructure are subject to regular independent security assessments and penetration testing by qualified cybersecurity professionals.
• Staff Training: All hand777 personnel with access to personal data receive mandatory data privacy and security training upon onboarding and at regular intervals thereafter.

Cookies & Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device by the hand777 Platform when you visit or use the service. They allow the Platform to recognise your device, maintain your login session, remember your preferences, and collect usage analytics.

11.2 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, CSRF protection tokens, and load balancing cookies. These cannot be disabled as they are essential to service delivery.
• Functional Cookies: Remember your preferences — such as preferred language, notification settings, and responsible gaming configurations — so you do not need to reset them on every visit.
• Analytics Cookies: Used by hand777 to understand how players interact with the Platform in aggregate — which game categories are most visited, where players experience difficulties, and how the mobile interface performs across devices. Analytics data is aggregated and does not identify individuals.
• Security Cookies: Used to detect and prevent fraudulent login attempts and to identify unusual account activity patterns that may indicate a compromised account.

11.3 Cookie Consent

On your first visit to hand777.app, you will be presented with a cookie consent notice. Strictly necessary and security cookies are placed without consent, as they are required for the Platform to operate. Functional and analytics cookies require your explicit consent before being set. You may withdraw consent at any time by adjusting your browser settings to block or delete cookies, though this may affect your experience on the Platform.

11.4 No Third-Party Advertising Cookies

hand777 does not use third-party advertising cookies, retargeting pixels, or any tracking technology designed to follow you across other websites. Tracking on the hand777 Platform is limited to what is necessary for security, functionality, and first-party analytics.

Minors & Age Verification

Age verification is conducted as part of the KYC process required before any withdrawal is processed. Where hand777 discovers or has reasonable grounds to believe that an account belongs to a person under the age of 21, the account will be immediately suspended, access to the Platform will be blocked, and any deposited funds will be returned to the funding source where technically feasible.

Any personal data knowingly collected from a minor will be deleted from hand777's systems as soon as the discovery is made, subject to any overriding legal retention obligation.

Exercising Your Data Rights

To exercise any of the rights described in this Policy — including access, rectification, erasure, objection, or data portability — please contact the hand777 Data Privacy Officer using the details in Section 17. All requests must include:

• Your full name as registered on hand777;
• Your registered mobile number or email address;
• A description of the specific right you wish to exercise and the data to which your request relates;
• A copy of a valid government-issued ID to verify your identity (required to prevent unauthorised access to another person's data).

hand777 will acknowledge receipt of your request within 5 business days and will fulfil the request within the timelines specified for each right in this Policy. Where a request cannot be fulfilled — for example, because the data must be retained for a legal purpose — hand777 will provide a written explanation of the reason.

There is no charge for exercising data rights in the ordinary course. Where a request is manifestly unfounded, excessive, or repetitive, hand777 reserves the right to charge a reasonable administrative fee or decline the request, with written justification provided to the requester.

Data Breach Response Procedure

In the event of a personal data breach that poses a real risk of serious harm to affected individuals, hand777 will:

1. Contain the breach immediately upon discovery, including isolating affected systems and suspending any ongoing unauthorised access;
2. Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by Section 20(f) of the Data Privacy Act and NPC Circular No. 2016-03;
3. Notify affected players within a reasonable period of the NPC notification, using the contact details on file, where the breach is likely to result in a risk to the rights and freedoms of those individuals;
4. Investigate the root cause and implement remediation measures to prevent recurrence;
5. Document the breach in hand777's internal breach register, regardless of whether NPC notification is required.

Breach notifications to players will be communicated via the email address or mobile number registered on the affected account and will describe the nature of the breach, the data involved, the likely consequences, and the steps hand777 has taken or proposes to take in response.

Complaints to the National Privacy Commission

If you believe that hand777 has mishandled your personal data or failed to honour your rights under the Data Privacy Act, we encourage you to first contact our Data Privacy Officer (Section 17) to attempt informal resolution. hand777 is committed to addressing all privacy concerns promptly and fairly.

If you remain unsatisfied after raising the matter with hand777, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for enforcing the Data Privacy Act and adjudicating privacy complaints against personal information controllers operating in the Philippines.

Policy Updates

hand777 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. Material changes — including changes to the categories of data collected, the purposes for which data is processed, or the rights available to players — will be communicated to registered players by email at least fourteen (14) days before the changes take effect.

The effective date of the current version of this Policy is displayed in the header of this page. Continued use of the hand777 Platform after the effective date of any update constitutes acceptance of the revised Policy. Players who do not accept a material change to this Policy should close their accounts before the effective date in accordance with the account closure procedure described in the Terms and Conditions.

The current and all previous versions of this Policy are maintained in hand777's internal policy archive. Players may request a copy of any previous version by contacting the DPO.

Contact Information & Data Privacy Officer

For any queries, requests, or complaints relating to this Privacy Policy or the handling of your personal data by hand777, please contact the Data Privacy Officer through the following channels:

• Email: [email protected] — please use the subject line "Data Privacy Request" for formal requests under the Data Privacy Act.
• Live Chat: Available 24/7 via the chat icon on any page of the hand777 Platform. Response time under 2 minutes for general queries.

For formal data subject access requests, erasure requests, or data breach complaints, written requests submitted by email with identity verification are preferred to ensure a proper audit trail. hand777 will acknowledge all formal privacy requests within 5 business days.