Privacy Policy — rech9 Online Casino

01Data Controller

rech9 is the data controller responsible for the personal data collected through the rech9 platform. As data controller, rech9 determines the purposes and means by which your personal data is processed. rech9 operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and in compliance with the National Privacy Commission (NPC) of the Philippines.

rech9 has appointed a Data Protection Officer (DPO) as required under the Philippine Data Privacy Act. The DPO is responsible for overseeing rech9's compliance with RA 10173, handling data subject requests, and acting as the primary point of contact for privacy-related matters. You may contact the rech9 DPO through the live chat support channel or by email at [email protected] with the subject line "DPO — Privacy Inquiry".

02Personal Data We Collect

rech9 collects personal data in the categories described in the table below. We only collect data that is necessary for the specific purpose identified:

rech9 does not collect sensitive personal information beyond what is strictly required for identity and age verification. rech9 does not collect biometric data, religious affiliation, political opinions, or health data unless specifically required by law.

03How We Collect Your Data

rech9 collects personal data through the following channels:

• Direct Collection: Data you provide voluntarily when registering a rech9 account, completing KYC verification, making a deposit or withdrawal, contacting rech9 support, or participating in a promotion.
• Automated Collection: Data collected automatically through cookies, web beacons, server logs, and similar technologies when you access and interact with the rech9 platform. This includes your IP address, device identifiers, and browsing behaviour within the rech9 site.
• Third-Party Sources: Data received from payment processors (e.g., GCash, Maya, InstaPay), identity verification service providers, fraud detection services, and PAGCOR databases for compliance purposes. All third-party sources are bound by confidentiality and data processing agreements.

04Purpose & Legal Basis for Processing

Under the Philippine Data Privacy Act, rech9 must have a lawful basis for processing each category of personal data. The following table sets out the primary purposes for which rech9 processes your data and the corresponding legal basis:

Where rech9 relies on your consent as the legal basis for processing (e.g., for promotional communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your notification preferences in your rech9 account settings or contact support via live chat.

05Data Sharing & Disclosure

rech9 does not sell, rent, or trade your personal data to any third party for their own independent marketing or commercial purposes. rech9 may share your personal data with the following categories of recipients, strictly as necessary:

• Payment Processors: GCash (Mynt), Maya (PayMaya Philippines), BancNet, and other licensed payment service providers, solely for the purpose of processing your financial transactions.
• KYC / Identity Verification Providers: Licensed third-party identity verification services that assist rech9 in verifying your identity and age in compliance with PAGCOR and AMLA requirements.
• Game Content Providers: Licensed game software providers whose platforms are integrated into the rech9 casino. These providers may collect limited technical and gameplay data directly for the purpose of delivering game content.
• IT and Security Service Providers: Cloud hosting, cybersecurity, and anti-fraud technology providers engaged by rech9 to maintain platform security and reliability. All such providers operate under strict data processing agreements.
• Regulatory Authorities: PAGCOR, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory directive.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by rech9, where access to personal data is necessary for their professional engagement and is subject to professional privilege and confidentiality obligations.

All third-party service providers engaged by rech9 are required to process personal data only on rech9's documented instructions and to implement appropriate technical and organisational measures to protect the security and confidentiality of that data.

06Cookies & Tracking Technologies

rech9 uses cookies and similar tracking technologies to operate the rech9 platform effectively, ensure platform security, and improve the player experience. The categories of cookies used by rech9 are as follows:

• Strictly Necessary Cookies: Essential for the operation of the rech9 platform. These cookies enable core functions such as session management, login authentication, and security. They cannot be disabled without affecting platform functionality.
• Functional Cookies: Enable rech9 to remember your preferences (such as language settings and last-visited game category) to provide a more personalised experience.
• Analytics Cookies: Used to collect anonymised or aggregated data about how players interact with the rech9 platform, helping rech9 identify areas for improvement. Analytics data does not identify you personally.
• Security Cookies: Used to detect and prevent fraudulent access, bot activity, and other security threats.

rech9 does not use third-party advertising cookies or behavioural profiling cookies for advertising networks outside of the rech9 platform. You may control cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair your ability to use the rech9 platform. A cookie consent banner is displayed on your first visit to the rech9 site.

07Data Retention

rech9 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by Philippine law or PAGCOR regulatory requirements. The following retention schedule applies:

• Account and Identity Data: Retained for a minimum of five (5) years from the date of account closure, as required by the Anti-Money Laundering Act (AMLA) of the Philippines.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with AMLC and PAGCOR requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years post-account closure or as required by PAGCOR licence conditions.
• Customer Support Communications: Retained for three (3) years from the date of the communication, for dispute resolution and quality assurance purposes.
• Technical and Usage Data: Retained for twelve (12) months in identifiable form, after which it may be anonymised and retained indefinitely for aggregate analytics purposes.
• Marketing Consent Records: Retained for the duration of the marketing relationship and for three (3) years after withdrawal of consent, as evidence of compliance.

Upon expiry of the applicable retention period, rech9 will securely delete or anonymise your personal data in accordance with the NPC's prescribed disposal standards.

08Data Security

rech9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction:

• Encryption: All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest (including financial data and KYC documents) is encrypted using AES-256.
• Two-Factor Authentication (2FA): rech9 strongly encourages all players to enable 2FA via SMS OTP on their accounts. Staff access to player data systems requires mandatory multi-factor authentication.
• Access Controls: Player personal data is accessible only to rech9 staff who require it for their specific job function. Access is governed by a role-based access control (RBAC) framework and is logged and audited.
• Security Monitoring: rech9 operates 24/7 security monitoring of its platform infrastructure, including intrusion detection systems and automated anomaly alerts.
• Penetration Testing: rech9 conducts regular third-party security assessments and penetration tests to identify and address vulnerabilities before they can be exploited.
• Data Breach Response: In the event of a personal data breach that is likely to result in significant harm to affected players, rech9 will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, as required by NPC Circular 16-03.

While rech9 takes all reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. rech9 cannot guarantee the absolute security of data transmitted over the public internet. You also have a role to play in protecting your account — keep your password strong and unique, enable 2FA, and never share your login credentials with anyone.

09Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by rech9:

To exercise any of the above rights, please contact the rech9 Data Protection Officer via live chat support (24/7) or by email at [email protected] with the subject line "Data Subject Request". rech9 will acknowledge your request within 3 business days and aim to fulfil it within 30 days. Complex requests may require up to 60 days, in which case rech9 will notify you of the extended timeline and the reason for it.

rech9 may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to an unauthorised person. In some cases, rech9 may be unable to fulfil a deletion or portability request in full due to ongoing legal or regulatory obligations — in such cases, rech9 will clearly explain the reason.

10Children & Minors

The rech9 platform is strictly intended for persons aged 21 years and above, as required under Philippine gaming regulations for casino-style online gambling. rech9 does not knowingly collect personal data from any person under the age of 21.

If rech9 becomes aware that personal data has been collected from a person under 21 years of age, rech9 will immediately suspend the relevant account, delete the personal data concerned, and — where required by law — notify the relevant Philippine authority. If you believe that a minor has registered a rech9 account, please contact rech9 support immediately via live chat.

rech9 employs age verification as a mandatory step during the account registration process. Users must confirm their date of birth and submit a valid government-issued identification document for KYC verification before their account is fully activated. Registration is not complete and real-money play is not permitted until this verification is successfully completed.

11Cross-Border Data Transfers

rech9 operates its primary data infrastructure within the Philippines. In some cases, personal data may be processed by rech9's third-party service providers in jurisdictions outside the Philippines — for example, cloud hosting providers operating data centres in Southeast Asia.

Where cross-border transfers of personal data occur, rech9 ensures that:

• The receiving country or organisation provides an adequate level of data protection, as determined by the NPC;
• Appropriate safeguards are in place — such as standard contractual clauses, binding corporate rules, or equivalent mechanisms recognised under RA 10173 — to protect your personal data; and
• The transfer is limited to the minimum data necessary for the specific processing purpose.

rech9 does not transfer personal data to jurisdictions that the NPC has identified as providing inadequate data protection without implementing the safeguards described above. You may request information about specific cross-border transfers by contacting the rech9 DPO.

12Third-Party Links

The rech9 website may contain links to third-party websites, such as payment processor portals (e.g., the GCash or Maya app), or informational resources. These links are provided for convenience only. rech9 has no control over the content or privacy practices of third-party websites and accepts no responsibility for them.

This Privacy Policy applies only to the rech9 platform. When you follow a link to a third-party website, that site's own privacy policy applies. rech9 encourages you to read the privacy policies of any third-party site you visit before providing any personal data to it.

13Policy Updates

rech9 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, NPC regulations, or PAGCOR requirements. When material changes are made, rech9 will notify registered players via the email address on file or through a prominent notice on the rech9 platform at least seven (7) days before the updated Policy takes effect.

The date at the top of this Policy indicates when it was last revised. The most current version of this Privacy Policy is always available at rech9.net/privacy-policy. Your continued use of the rech9 platform after a revised Policy takes effect constitutes your acceptance of the revised terms.

If you do not agree with any material change to this Privacy Policy, you must stop using the rech9 platform and request account closure via live chat support. rech9 will process your closure request and handle any remaining balance in accordance with the Terms & Conditions.

14Contact & Data Protection Officer

For all privacy-related inquiries, data subject requests, or complaints regarding rech9's handling of your personal data, please contact the rech9 Data Protection Officer through the following channels:

• Live Chat: Available 24/7 on the rech9 platform. Average response time is 3–5 minutes. For DPO matters, please state "DPO Request" at the start of your chat.
• Email: [email protected] — subject line: "DPO — Privacy Inquiry" (plain text — not a clickable link)

If you are not satisfied with rech9's response to your privacy inquiry or data subject request, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines. The NPC is the competent supervisory authority for data protection matters in the Philippines and can be reached through the official NPC website.

This Privacy Policy was last updated on January 1, 2026. Previous versions are archived and available upon written request to the rech9 DPO. This Policy is available in English only. In the event of any translation or interpretation dispute, the English version shall prevail.