27vip Privacy Policy

1. Data Controller

1.1 The data controller responsible for your personal information is 27vip, operating the online gaming platform accessible at 27vip.app ("the Platform").

1.2 For all data privacy enquiries, requests, and complaints, you may contact the 27vip Data Protection Officer (DPO) at: [email protected]

1.3 27vip is committed to complying with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

2. Scope of This Policy

2.1 This Policy applies to all personal data collected and processed by 27vip in connection with:

• Account registration and identity verification;
• Deposits, withdrawals, and payment processing;
• Gameplay, betting, and bonus participation;
• Customer support interactions;
• Marketing and promotional communications;
• Technical operation and security monitoring of the Platform.

2.2 This Policy applies to all registered players, prospective players who browse the Platform without registration, and any other persons whose personal data is processed by 27vip.

3. Personal Data We Collect

3.1 Registration Data. When you create a 27vip account, we collect: your full legal name, Philippine mobile number, date of birth, and chosen username and password.

3.2 Identity Verification (KYC) Data. To comply with anti-money laundering (AML) regulations and PAGCOR standards, 27vip may collect: copies of government-issued Philippine identification documents (e.g., PhilSys ID, driver's licence, passport), selfie photographs for liveness verification, and proof of payment method ownership (e.g., screenshot of GCash or PayMaya account).

3.3 Financial Data. Transaction records including deposit amounts, withdrawal requests, payment method identifiers (e.g., last four digits of a GCash-linked number, BDO account number), and transaction timestamps. 27vip does not store full payment account credentials — payment processing is handled by regulated third-party payment providers.

3.4 Gaming Activity Data. Records of games played, bets placed, game outcomes, session duration, and betting patterns. This data is used for player account management, bonus administration, responsible gaming monitoring, and regulatory reporting.

3.5 Device and Technical Data. IP address, device type, operating system, browser type, referring URL, and session identifiers collected automatically when you access the Platform.

3.6 Communications Data. Records of correspondence between you and 27vip customer support, including live chat transcripts, and records of any complaints or disputes submitted.

3.7 Marketing Preferences. Your opt-in or opt-out choices with respect to 27vip promotional communications via SMS.

4. How We Collect Your Data

27vip collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in a promotion;
• Automatically — through cookies, session tracking, and server logs when you access the Platform (see Section 10 on Cookies);
• From third parties — from payment service providers (e.g., GCash, PayMaya, BPI, BDO, Metrobank) confirming transaction details; from identity verification service providers used to assist KYC processes; and from fraud prevention and AML screening databases as required by Philippine law.

5. Purpose of Processing

27vip processes your personal data for the following purposes:

• Account creation and management — to register, maintain, verify, and administer your 27vip account;
• Transaction processing — to process deposits, withdrawals, and bonus payments in Philippine pesos;
• Regulatory compliance — to fulfil KYC, AML, and PAGCOR-related reporting obligations;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, account misuse, and security incidents;
• Customer support — to respond to queries, resolve disputes, and improve service quality;
• Responsible gaming — to monitor betting patterns for problem gambling indicators and apply player protection measures;
• Marketing — to send you promotional offers, bonuses, and platform updates via SMS, where you have consented to receive such communications;
• Platform improvement — to analyse aggregate usage data and improve the 27vip gaming experience.

6. Legal Basis for Processing

6.1 Contractual necessity. Processing of registration, KYC, financial, and gameplay data is necessary to provide the services described in our Terms & Conditions. Without this processing, 27vip cannot operate your account.

6.2 Legal obligation. Certain processing — particularly KYC verification, AML screening, and regulatory reporting — is required by Philippine law, including the Anti-Money Laundering Act (RA 9160 as amended) and applicable PAGCOR regulations.

6.3 Consent. Marketing communications are sent only where you have provided explicit consent. You may withdraw this consent at any time by contacting 27vip support.

6.4 Legitimate interests. Technical data and usage analytics are processed on the basis of 27vip's legitimate interest in maintaining platform security, preventing fraud, and improving service quality, provided these interests are not overridden by your data protection rights.

7. Data Sharing and Disclosure

7.1 27vip does not sell, rent, or trade your personal data to third parties for their own marketing purposes.

7.2 27vip may share your personal data with the following categories of recipients where strictly necessary:

• Payment service providers (GCash, PayMaya, BPI, BDO, Metrobank) — to process deposits and withdrawals;
• Identity verification providers — to perform KYC checks as required by regulation;
• Fraud prevention and AML screening services — to comply with anti-money laundering obligations;
• Technology and hosting providers — third-party service providers who operate the infrastructure supporting the 27vip Platform, bound by confidentiality and data processing agreements;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or any other Philippine government authority where disclosure is required by law or court order.

7.3 All third-party processors engaged by 27vip are contractually required to handle personal data in accordance with Philippine data privacy law and to implement appropriate security measures.

8. Data Retention

8.1 27vip retains personal data for as long as is necessary for the purposes set out in this Policy and to comply with legal obligations. The following standard retention periods apply:

• Account and KYC records: Retained for a minimum of five (5) years from account closure, in accordance with AML record-keeping requirements under Philippine law;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity logs: Retained for three (3) years from the date of the session;
• Customer support records: Retained for two (2) years from the date of the interaction;
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of the prior consent.

8.2 Following expiry of the applicable retention period, personal data is securely deleted or anonymised.

9. Security Measures

9.1 27vip implements a multi-layered data security framework to protect your personal information against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the 27vip Platform — the same standard used by Philippine banks for online transactions;
• Encryption at rest for sensitive personal and financial data stored in 27vip's databases;
• Strict access controls — only authorised 27vip personnel with a demonstrable business need may access personal data, and all access is logged and audited;
• Two-factor authentication available for all player accounts to reduce the risk of unauthorised account access;
• Regular security assessments and penetration testing of the Platform's infrastructure;
• Player account monitoring to detect unusual login activity or transaction patterns that may indicate account compromise.

9.2 In the event of a personal data breach that poses a real risk to affected individuals, 27vip will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with NPC Circular 16-03.

10. Cookies and Tracking Technologies

10.1 27vip uses cookies and similar technologies to operate the Platform, remember your session and preferences, prevent fraud, and analyse Platform usage.

10.2 The following categories of cookies are used by 27vip:

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load-balancing cookies;
• Functional cookies: Used to remember your preferences (e.g., language, game lobby layout) to provide a personalised experience;
• Analytics cookies: Used to collect anonymised data on how players use the Platform — which pages are visited, how long sessions last, and which games are most popular. This data is used solely to improve 27vip services;
• Security cookies: Used to detect and prevent fraudulent logins and bot activity.

10.3 You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect Platform functionality. 27vip does not use third-party advertising cookies.

11. Your Data Privacy Rights

11.1 Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, you have the following rights with respect to your personal data held by 27vip:

• Right to be informed — you have the right to know that your personal data is being collected and processed, the purposes for which it is processed, and your rights under this Policy;
• Right of access — you may request a copy of the personal data 27vip holds about you;
• Right to rectification — you may request correction of inaccurate or incomplete personal data;
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations;
• Right to object — you may object to the processing of your personal data for direct marketing purposes at any time;
• Right to data portability — where technically feasible, you may request a structured, machine-readable copy of your personal data;
• Right to file a complaint — you have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

11.2 To exercise any of the above rights, please contact the 27vip Data Protection Officer at [email protected]. 27vip will respond to verified requests within thirty (30) days.

12. Minors and Age Restriction

12.1 27vip does not knowingly collect personal data from individuals under the age of 21. The 27vip Platform is strictly for adults aged 21 and above.

12.2 If 27vip becomes aware that personal data has been collected from a person under 21, that data will be immediately deleted and the associated account permanently closed.

12.3 Parents and guardians who believe a minor may have registered on 27vip are encouraged to contact [email protected] immediately.

13. Cross-Border Data Transfers

13.1 Where 27vip engages third-party service providers located outside the Philippines — for example, game software providers or international hosting infrastructure partners — personal data may be transferred to those parties in jurisdictions outside the Philippines.

13.2 Any such transfers are conducted in accordance with the Philippine Data Privacy Act and NPC guidelines. 27vip ensures that appropriate contractual safeguards are in place, including data processing agreements that require the overseas recipient to implement data protection standards equivalent to those required under Philippine law.

14. Changes to This Privacy Policy

14.1 27vip may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes will be communicated to registered players via SMS to the registered Philippine mobile number and/or via a notice on the 27vip Platform at least seven (7) days before taking effect.

14.2 The date of the most recent update is displayed at the top of this Policy. Continued use of 27vip following notification of an updated Policy constitutes acceptance of the revised terms.

15. Contact the Data Protection Officer

For all data privacy queries, access requests, corrections, deletion requests, or complaints, please contact the 27vip Data Protection Officer:

You also have the right to file a complaint directly with the National Privacy Commission of the Philippines. Information on how to do so is available on the NPC's official website.