nurtar Privacy Policy

1 Scope & Data Controller

This Privacy Policy applies to all personal data collected and processed by nurtar Casino ("nurtar," "we," "us," or "our") in connection with the nurtar platform accessible at nurtar.org, including all gaming services, account management features, customer support channels, and promotional communications.

nurtar is the data controller for personal data collected through this Platform. As data controller, nurtar determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with the Philippine Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations.

This Policy governs the collection and processing of personal data of Philippine residents who are members of or visitors to the nurtar platform. For data subjects located in jurisdictions other than the Philippines, nurtar will apply the privacy protections described in this Policy to the extent they meet or exceed applicable local requirements.

2 Personal Data We Collect

nurtar collects personal data that is necessary for the provision of our gaming platform services, compliance with PAGCOR regulatory requirements, and fulfilment of our obligations under Philippine law. The categories of personal data we collect are as follows:

2.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (for age verification — must be 21 or above);
• Philippine mobile number;
• Email address;
• Permanent residential address;
• Government-issued ID details (PhilSys National ID, driver's licence, or passport number and expiry).

2.2 Financial & Payment Data

• GCash account mobile number linked to your nurtar wallet;
• PayMaya account details where used as a payment method;
• Bank account details (BPI, BDO, Metrobank) where used for deposits or withdrawals;
• Transaction history including deposit amounts, withdrawal requests, and timestamps.

nurtar does not store full payment card numbers. All payment processing is handled by PCI-DSS compliant payment processors, with nurtar retaining only tokenised references necessary for transaction record-keeping.

2.3 KYC Verification Data

• Photographs or scans of government-issued identity documents;
• Selfie photographs submitted for facial verification purposes;
• Source of funds declarations where required by PAGCOR AML compliance obligations.

2.4 Gaming Activity Data

• Game session history (titles played, session duration, stakes, outcomes);
• Sports betting history (markets, wager amounts, results);
• Bonus and promotional activity logs;
• Responsible gaming settings and limit configurations;
• Self-exclusion and cooling-off records.

2.5 Technical & Device Data

• IP address at time of login and registration;
• Device type, operating system, and browser version;
• Session identifiers and authentication tokens;
• Login timestamps and geographic location derived from IP address.

2.6 Communications Data

• Live chat transcripts with nurtar support agents;
• Email correspondence with nurtar;
• Records of consent to marketing communications and subsequent opt-out requests.

3 How We Collect Your Data

nurtar collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, place a wager, contact customer support, or update your account settings;
• Automatically — through cookies, session tracking, and server logs when you access and navigate the Platform (see Section 9 for full cookie details);
• From third-party service providers — identity verification platforms that process your KYC documents return structured verification results to nurtar; payment processors confirm transaction status; game providers transmit session result data;
• From public sources — where required for AML due diligence, nurtar may reference publicly available information to supplement identity or source of funds verification.

4 Purposes & Legal Basis for Processing

nurtar processes personal data only where there is a lawful basis for doing so under RA 10173. The following table summarises our processing purposes and the applicable legal basis for each:

5 Sharing Your Personal Data

nurtar does not sell, rent, or trade your personal data. We share personal data with third parties only where strictly necessary for the purposes outlined in this Policy and only with parties who are bound by appropriate data protection obligations.

Categories of third parties with whom nurtar may share your personal data include:

• KYC and identity verification providers — for the purpose of verifying your identity and age in compliance with PAGCOR regulations. These providers process document images and return structured verification results;
• Payment processors — GCash, PayMaya, BPI, BDO, and Metrobank or their processing partners, for the purpose of executing deposit and withdrawal transactions. Sharing is limited to the transaction data each processor requires;
• Game software providers — gaming studios such as PG Soft, Pragmatic Play, and other platform suppliers receive the minimum session data necessary to operate their game titles, including session identifiers and wager amounts. These providers do not receive your full identity data;
• Cloud infrastructure and hosting providers — nurtar uses secure cloud infrastructure to operate the Platform. Providers are contractually bound to process data only on nurtar's instructions and in accordance with applicable privacy law;
• PAGCOR and Philippine regulatory authorities — nurtar is obligated by law to report certain information to PAGCOR, including player activity reports required under PAGCOR's online gaming regulations and transaction reports required under RA 9160 (Anti-Money Laundering Act);
• Law enforcement and government agencies — where nurtar is required to disclose data pursuant to a lawful court order, subpoena, or regulatory directive from a competent Philippine authority;
• Professional advisers — legal counsel, auditors, and insurers under obligations of professional confidentiality, where access to personal data is necessary for the relevant professional service.

6 International Data Transfers

Some of nurtar's service providers and game software partners operate servers or processing facilities outside the Philippines. Where your personal data is transferred to a jurisdiction outside the Philippines, nurtar ensures that adequate safeguards are in place to protect your data at a standard equivalent to or exceeding the protections provided by RA 10173.

Safeguards employed for international transfers include:

• Standard contractual clauses approved by the National Privacy Commission (NPC) or equivalent supervisory authority;
• Data processing agreements with binding obligations equivalent to those required under RA 10173;
• Transfer to jurisdictions with an NPC-recognised adequate level of data protection;
• Explicit consent from the data subject where other transfer mechanisms are unavailable.

You may contact nurtar's Data Protection Officer (see Section 15) to request details of the specific safeguards applied to any international transfer of your personal data.

7 Data Retention

nurtar retains personal data for as long as is necessary for the purposes for which it was collected, or for the minimum period required by applicable law, whichever is longer. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or rendered permanently anonymous. Anonymous or aggregated data derived from your account activity may be retained indefinitely for platform analytics purposes, as it no longer constitutes personal data.

8 Security Measures

nurtar implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and nurtar's servers;
• Encryption at rest for sensitive data categories including KYC documents and financial identifiers;
• Role-based access controls ensuring that only authorised nurtar personnel with a legitimate operational need can access specific data categories;
• Multi-factor authentication required for all internal systems access by nurtar staff;
• Regular security audits and penetration testing of Platform infrastructure;
• Intrusion detection systems monitoring for anomalous access patterns;
• Data breach response procedures including mandatory NPC notification within 72 hours where a breach is likely to result in risk to data subjects.

While nurtar maintains robust security measures, no digital transmission or storage system is completely immune to breach. You should use a strong, unique password for your nurtar account, enable two-factor authentication, and contact support immediately if you suspect any unauthorised access.

9 Cookies & Tracking Technologies

nurtar uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled as the Platform cannot function without them.
• Functional Cookies: Remember your preferences such as language settings, responsible gaming limit configurations, and last-visited game categories. Disabling these cookies may reduce Platform functionality.
• Analytics Cookies: Collect anonymised data about how members navigate the Platform, which features are used, and where technical issues occur. This data is aggregated and does not identify individual members. Used to improve Platform performance.
• Security Cookies: Detect fraud and abuse patterns, including identifying multiple accounts from the same device or IP address, and flagging unusual login behaviour.

nurtar does not use third-party advertising or retargeting cookies. Cookies from game providers are limited to the scope of their embedded game frames and are governed by those providers' own cookie policies.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will prevent Platform access. For other cookie categories, you may opt out through your browser's cookie management tools without affecting core Platform functionality.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you hold the following rights with respect to your personal data processed by nurtar. nurtar is committed to facilitating the exercise of these rights without undue delay and at no cost to you.

To exercise any of the above rights, submit a written request to nurtar's Data Protection Officer at the contact details provided in Section 15. nurtar will respond within 15 business days of receiving a complete and verified request. Where additional time is required for complex requests, you will be notified and kept informed of progress.

11 Children & Minors

Where nurtar becomes aware that personal data has been collected from an individual below the age of 21, all data associated with that individual will be permanently deleted and the associated account will be immediately closed. Any deposits made by an underage individual will be returned to the source payment method.

The Platform employs mandatory KYC age verification prior to the commencement of real-money play. This verification step is specifically designed to prevent underage individuals from accessing gaming services on the nurtar Platform.

12 Marketing Communications

nurtar may send marketing communications — including promotional offers, bonus notifications, game launch announcements, and event invitations — to members who have explicitly opted in to receiving such communications during registration or through their Account Settings.

Marketing communications are sent via email and/or SMS to your registered contact details. You may opt out of marketing communications at any time by:

• Updating your communication preferences in Account Settings;
• Clicking the unsubscribe link in any nurtar marketing email;
• Contacting nurtar support to request removal from marketing lists.

Opting out of marketing communications will not affect transactional notifications — nurtar will continue to send account security alerts, deposit confirmations, withdrawal processing updates, and responsible gaming notifications regardless of your marketing preferences, as these are required for the operation of your account.

13 Third-Party Links & Embedded Content

The nurtar platform may contain links to third-party websites or embedded content from third-party game providers. This Privacy Policy applies solely to personal data collected by nurtar through nurtar.org. nurtar is not responsible for the privacy practices of third-party websites or services.

Game content embedded within the nurtar Platform from third-party studios operates within sandboxed environments. These providers are contractually restricted from collecting personal data beyond what is necessary for game operation and are prohibited from using data collected within nurtar's Platform for their own commercial purposes.

nurtar recommends that you review the privacy policies of any third-party services you access directly, outside of the nurtar Platform environment.

14 Updates to This Privacy Policy

nurtar may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to members via their registered email address and/or a prominent notice on the Platform, with at least seven (7) days' advance notice before the changes take effect.

The date of the most recent update is displayed at the top of this page. The version published on this page supersedes all prior versions. Continued use of the nurtar Platform following publication of an updated Privacy Policy constitutes your acceptance of the revised Policy.

Where changes to this Policy require your renewed consent under RA 10173 — for example, if we introduce a new processing purpose that requires consent as its legal basis — we will seek that consent separately before commencing the new processing activity.

15 Contact & Data Protection Officer

nurtar has appointed a Data Protection Officer (DPO) in accordance with Section 21 of RA 10173 and NPC Circular 16-01. The DPO is responsible for overseeing nurtar's data protection programme and serving as the primary point of contact for data subject rights requests, privacy enquiries, and regulatory communications.

To contact nurtar's Data Protection Officer or to exercise any of your rights under this Privacy Policy, you may reach us through the following channels:

• Email (DPO): [email protected] — please include "DPO Request" in your subject line
• Live Chat: Available 24/7 within the nurtar Platform for members who are logged in
• Response Time: We aim to acknowledge all DPO enquiries within 2 business days and resolve substantive requests within 15 business days

If you are not satisfied with nurtar's response to your privacy enquiry or data subject rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing RA 10173.