star99
Privacy Policy

1 Introduction

star99 ("star99", "we", "us", "our") operates the online gaming platform accessible at star99.cam under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR). In the course of providing our services to Filipino players, star99 collects and processes personal data about registered account holders and, in limited circumstances, visitors to our website.

This Privacy Policy ("Policy") sets out how star99 collects, uses, stores, shares, and protects personal data, and explains the rights available to data subjects under Philippine law. The Policy applies to all data processing activities carried out by star99 in connection with the star99 platform. It should be read alongside the star99 Terms & Conditions.

star99 takes its obligations under the Data Privacy Act of 2012 (RA 10173) and the regulations of the National Privacy Commission (NPC) seriously. We are committed to handling all personal data with transparency, proportionality, and respect for the privacy rights of every Filipino player on our platform.

2 Data Controller

For the purposes of the Data Privacy Act of 2012, star99 is the personal information controller responsible for the personal data collected through the star99 platform. Questions, requests to exercise data subject rights, and complaints relating to this Policy should be directed to star99's Data Protection Officer (DPO) using the contact details provided in Section 15 of this Policy.

3 Personal Data We Collect

star99 collects personal data in the following categories:

3.1 Registration & Account Data

When you create a star99 account, we collect:

• Full legal name (as it appears on a Philippine government-issued ID)
• Date of birth (to verify the mandatory 21+ age requirement)
• Philippine mobile number
• Email address
• Username and hashed password (passwords are never stored in plain text)
• Registered address in the Philippines

3.2 Identity Verification (KYC) Data

To comply with PAGCOR licensing requirements and the Anti-Money Laundering Act (AMLA) as amended, star99 is required to verify the identity of account holders before processing withdrawals above prescribed thresholds. KYC data may include:

• Scanned copy or photograph of a government-issued Philippine ID (PhilSys National ID, UMID, SSS card, Driver's License, or Passport)
• Selfie or live-capture photograph for liveness verification
• Proof of address (utility bill, bank statement, or government-issued document showing your registered address)

3.3 Financial & Transaction Data

star99 records all financial transactions associated with your account, including deposit amounts, payment methods used (GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard), withdrawal requests, transaction timestamps, and account balance history. We do not store full payment card numbers — these are handled by our PCI-DSS compliant payment processing partners.

3.4 Gaming Activity Data

star99 logs all gaming activity associated with your account, including game sessions, bet amounts, game outcomes, and session durations. This data is used for account integrity, responsible gaming monitoring, regulatory reporting, and dispute resolution purposes.

3.5 Technical & Device Data

When you access the star99 platform, we automatically collect:

• IP address and approximate geolocation (country/region level)
• Device type, model, and operating system
• Browser type and version
• Login timestamps and session duration
• Device fingerprint (for fraud prevention and duplicate account detection)

3.6 Communications Data

Where you contact star99's customer support — via live chat, email, or any other channel — we retain records of that communication for quality assurance, dispute resolution, and regulatory compliance purposes.

4 Purpose of Processing & Legal Basis

star99 processes personal data for the following purposes:

• Account registration and management: to create, verify, and maintain your star99 account.
• Age and identity verification: to ensure all players meet the mandatory 21+ age requirement under Philippine law and PAGCOR regulations.
• Payment processing: to process GCash, PayMaya, and bank transfer deposits and withdrawals in Philippine Peso.
• Service provision: to deliver the gaming services you have contracted with us to receive, including live casino, slots, bingo, e-sports, and all other platform features.
• Legal and regulatory compliance: to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and National Privacy Commission requirements — including mandatory transaction monitoring and reporting obligations.
• Fraud prevention and security: to detect and prevent fraudulent activity, duplicate accounts, money laundering, and unauthorised access.
• Responsible gaming: to monitor gaming behaviour patterns for signs of problem gambling and to administer responsible gaming tools.
• Customer support: to respond to and resolve account queries, payment issues, and complaints.
• Direct marketing: to send you promotional communications about star99 offers and new features, where you have provided consent or where permitted by applicable law.
• Platform improvement: to analyse aggregated, de-identified usage data to improve the star99 platform experience for Filipino players.

5 Data Sharing & Disclosure

star99 does not sell or rent personal data to third parties. star99 may share personal data in the following limited circumstances:

• Payment processors: GCash (Mynt), PayMaya (Maya Philippines), and our banking partners (BPI, BDO, Metrobank) receive transaction data necessary to process deposits and withdrawals. These entities are bound by their own privacy obligations and PCI-DSS standards.
• Identity verification providers: Third-party KYC service providers who assist with document verification and liveness checks. These providers process data solely for verification purposes under data processing agreements with star99.
• PAGCOR: As a licensed operator, star99 is required to submit certain transaction and player activity reports to PAGCOR under its licensing conditions.
• Anti-Money Laundering Council (AMLC): star99 is required to report covered and suspicious transactions to the AMLC under the Anti-Money Laundering Act of 2001 (RA 9160) as amended.
• Law enforcement and courts: Where required by a valid court order, subpoena, or lawful request from Philippine law enforcement authorities.
• Game technology providers: Game software providers who supply live dealer and RNG game content may receive anonymised session data for game integrity and audit purposes.
• Professional advisers: Lawyers, auditors, and insurers who are bound by professional confidentiality obligations, where necessary for the operation of our business.

All third parties who receive personal data from star99 are required to handle that data in a manner consistent with this Privacy Policy and applicable Philippine data protection law.

6 Data Retention

star99 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to the following minimum retention periods required by law or regulation:

• KYC and identity documents: A minimum of five (5) years from account closure, as required by PAGCOR licensing conditions and AMLA regulations.
• Financial transaction records: A minimum of five (5) years from the date of the transaction, in accordance with AMLA requirements.
• Gaming activity logs: A minimum of two (2) years from the date of the activity, and longer where a dispute or regulatory investigation is pending.
• Account data (closed accounts): Up to seven (7) years from account closure, to facilitate regulatory audits and legal proceedings.
• Support communications: Two (2) years from the date of the communication, or longer if related to an unresolved dispute.

On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised, aggregated data that cannot be used to identify any individual may be retained indefinitely for statistical analysis.

7 Security Measures

star99 implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we hold. These measures include:

• TLS 1.3 encryption for all data in transit between your device and the star99 platform
• AES-256 encryption for sensitive data at rest, including KYC documents and financial records
• Hashed and salted storage of all account passwords — plain text passwords are never stored
• Two-factor authentication (2FA) via SMS OTP, available and recommended for all accounts
• Role-based access controls restricting employee access to personal data on a need-to-know basis
• Device fingerprinting and fraud monitoring to detect and respond to unauthorised access attempts
• Regular security audits and penetration testing of the star99 platform
• Secure, access-controlled storage for KYC documents and government ID data

While star99 implements robust security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for enabling 2FA on your account as an additional layer of protection.

8 Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules, you have the following rights with respect to your personal data held by star99:

To exercise any of the above rights, please submit a written request to star99's Data Protection Officer using the contact details in Section 15. star99 will respond to verifiable data subject requests within fifteen (15) calendar days where feasible, or within the period prescribed by NPC regulations.

9 Cookies & Tracking Technologies

The star99 website uses cookies and similar tracking technologies to enhance your user experience, maintain your login session, and collect anonymised analytics data. The types of cookies used by star99 include:

• Strictly Necessary Cookies: Required for the platform to function, including session management and login state. These cannot be disabled without disrupting your use of the platform.
• Functional Cookies: Remember your preferences such as language settings and display options.
• Analytics Cookies: Collect anonymised data about how players interact with the platform, used to improve the user experience. These do not identify you personally.
• Security Cookies: Used for fraud detection, bot prevention, and account security monitoring.

star99 does not use cookies to track your browsing activity on third-party websites outside of the star99 platform. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will impair your ability to log in and use the platform.

10 Direct Marketing

Where you have provided consent, star99 may send you promotional communications about new games, platform features, bonuses, and special offers via SMS or email to your registered contact details. You may withdraw consent for direct marketing at any time by:

• Updating your communication preferences in your star99 account settings; or
• Clicking the unsubscribe link included in any marketing email; or
• Contacting star99's customer support or DPO directly.

Withdrawal of consent for marketing communications does not affect the lawfulness of processing carried out prior to withdrawal, and does not prevent star99 from sending you service-related communications (such as account notices, security alerts, and transaction confirmations) that are necessary for the management of your account.

11 Data of Minors

star99 does not knowingly collect personal data from individuals under the age of 21 years. The star99 platform is strictly restricted to adults aged 21 and over in accordance with PAGCOR regulations and Philippine gaming law. If star99 becomes aware that personal data has been collected from an individual under 21, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor under your care has registered a star99 account or submitted personal data to our platform, please contact our Data Protection Officer immediately using the contact details in Section 15.

12 Cross-Border Data Transfers

In the course of operating the star99 platform, personal data may be transferred to and processed by third-party service providers located outside the Philippines — for example, cloud infrastructure providers, game technology suppliers, or cybersecurity service providers. Where such transfers occur, star99 ensures that:

• The recipient country or organisation provides an adequate level of data protection consistent with the standards of the Data Privacy Act of 2012; or
• Appropriate contractual safeguards are in place, including data processing agreements incorporating the standard contractual clauses recognised by the National Privacy Commission; and
• The transfer is limited to the minimum data necessary for the specific purpose.

13 Data Breach Notification

In the event of a personal data breach that is likely to result in a real risk of serious harm to affected data subjects, star99 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03 and applicable regulations. Where the breach is likely to adversely affect your rights and freedoms, star99 will also notify you directly without undue delay, providing information about the nature of the breach, the data affected, and the steps we are taking to address it.

14 Amendments to This Policy

star99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.

Where changes to this Policy are material — meaning they significantly affect your rights or how your data is used — star99 will notify registered account holders via email or in-platform notification prior to the changes taking effect, giving you reasonable time to review the updated Policy. Continued use of the star99 platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

15 Contact & Data Protection Officer

For all data privacy-related inquiries, requests to exercise data subject rights, or concerns about this Privacy Policy, please contact star99's Data Protection Officer (DPO):

• Email: [email protected] (please mark the subject line: "Data Privacy Request")
• Live Chat: Available 24/7 from within your star99 account dashboard
• FAQ: Visit the star99 Help Centre

If you are not satisfied with star99's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph.

This Privacy Policy was last updated on 1 January 2026 and supersedes all previous versions.