Privacy Policy — tmt33 Online Casino Platform

1.1 tmt33 ("we," "us," "our") is the data controller responsible for the personal data of Users who access and interact with the tmt33 online gaming platform. As data controller, tmt33 determines the purposes and means of processing personal data as described in this Privacy Policy.

1.2 tmt33 takes data privacy seriously. This Privacy Policy is written in plain language — as required by the Data Privacy Act — so that every Filipino player can clearly understand what personal information is handled, why it is handled, and what rights each player holds.

1.3 This Privacy Policy should be read together with tmt33's Terms and Conditions, which contain additional provisions relevant to User rights and responsibilities on the platform. In the event of conflict between this Privacy Policy and the Terms and Conditions on a privacy-specific matter, this Privacy Policy shall prevail.

1.4 By registering for a tmt33 account or by continuing to use the tmt33 platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should not create a tmt33 account or continue using the platform.

2.1 tmt33 collects personal data through several channels: information you provide directly during registration and KYC, information generated through your use of the platform, and — where applicable — information received from third-party service providers (e.g., payment processors, identity verification providers).

2.2 The categories of personal data tmt33 collects include:

2.3 tmt33 does not knowingly collect sensitive personal data (as defined under the Data Privacy Act — e.g., health information, political affiliations, biometric data) beyond what is strictly required for KYC identity verification purposes (facial comparison image). Such biometric data is used solely for identity verification and is processed in accordance with applicable NPC guidelines.

2.4 Where you provide personal data of third parties (for example, a registered payment account holder's details), you represent and warrant that you have the consent or lawful authority to provide that information to tmt33.

3.1 tmt33 uses personal data for the following purposes, each of which has a corresponding lawful basis set out in Section 4 below:

• Account creation and management: Processing your registration, verifying your identity and age (21+ requirement), maintaining your account, and providing access to tmt33 services;
• Provision of gaming services: Processing bets, recording game results, crediting winnings, and maintaining gaming history;
• Payment and cashier operations: Processing deposits and withdrawals via GCash, Maya, bank transfer, and other supported Philippine payment channels;
• Regulatory compliance: Fulfilling obligations under Philippine law, including PAGCOR regulatory requirements, the Anti-Money Laundering Act (AMLA), and KYC obligations;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviors, enforcing self-exclusion orders, and applying deposit limits set by Users or required by regulation;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account compromise, and other unlawful activity on the tmt33 platform;
• Customer support: Responding to enquiries, complaints, and disputes submitted via live chat, email, or other support channels;
• Platform improvement: Analyzing aggregated, anonymised usage data to improve platform performance, game selection, and user experience;
• Direct marketing (where consent is given): Sending promotional offers, bonus notifications, and platform news to Users who have opted in to marketing communications.

3.2 tmt33 does not use personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by regulatory compliance systems (e.g., automated AML transaction screening). Where automated screening flags a transaction, a human tmt33 compliance officer reviews the flag before any action affecting a player's account is taken.

4.1 Under the Data Privacy Act of 2012 and its IRR, tmt33 relies on the following legal grounds to process personal data:

• Performance of a contract: Processing necessary to provide tmt33 services to a registered User, including account management, payment processing, and game operation;
• Compliance with a legal obligation: Processing required by Philippine law, including KYC/AML obligations under the AMLA, PAGCOR reporting requirements, and NPC registration;
• Legitimate interests: Processing for fraud prevention, platform security, and platform improvement, where such interests are not overridden by the data subject's rights and interests;
• Consent: Processing for direct marketing communications, and for non-essential cookies and tracking technologies, where Users have provided explicit, informed consent;
• Protection of vital interests: In limited circumstances, processing necessary to protect the vital interests of a data subject or another person (e.g., responsible gaming interventions where a player's wellbeing is at risk).

4.2 Where tmt33 relies on consent as the legal basis for any processing activity, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5.1 tmt33 uses cookies and similar tracking technologies (e.g., web beacons, local storage, session tokens) on its platform. Cookies are small text files stored on your device that help tmt33 provide a functional, secure, and personalized experience.

5.2 tmt33 uses the following categories of cookies:

• Strictly necessary cookies: Required for core platform functionality — user authentication, session management, security tokens, and cashier operations. These cannot be disabled without affecting basic platform functionality.
• Performance and analytics cookies: Used to collect anonymised data about how Users interact with tmt33 — page load times, navigation paths, error rates — to improve platform performance.
• Functionality cookies: Remember your preferences such as language settings, game category filters, and display preferences.
• Marketing cookies (consent-based): Used to track whether promotional offers have been displayed and interacted with. These are placed only where you have provided explicit consent.

5.3 You can control non-essential cookies through your browser settings or through the tmt33 cookie preference centre (accessible from the footer of the platform). Disabling certain cookies may affect platform functionality. Strictly necessary cookies cannot be disabled.

5.4 tmt33 does not use third-party advertising networks or retargeting cookies that share your data with external marketing platforms.

6.1 tmt33 may share your personal data with the following categories of third parties:

• Payment processors: GCash (Globe Fintech Innovations, Inc.), Maya (Voyager Innovations, Inc.), Bancnet, and participating Philippine banks — for the sole purpose of processing your deposits and withdrawals;
• KYC and identity verification providers: Certified third-party identity verification services used to validate the authenticity of submitted government IDs and to confirm age requirements are met;
• Game content providers: Software providers who supply the casino games available on tmt33 may receive anonymised session data for game analytics. They do not receive your identity or financial data;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC), where tmt33 is legally required to report or provide information;
• Law enforcement: Philippine law enforcement authorities, where tmt33 is compelled to disclose information by lawful order, warrant, or court process;
• IT infrastructure and cloud service providers: Hosting, security, and infrastructure providers who process data on tmt33's behalf under binding data processing agreements that impose equivalent data protection obligations.

6.2 All third parties with whom tmt33 shares personal data are required by contract to: process that data solely for the stated purpose; maintain appropriate technical and organisational security measures; not further disclose the data without tmt33's written authorisation; and comply with applicable Philippine data privacy law.

6.3 Where personal data is transferred outside the Philippines to service providers in other jurisdictions, tmt33 ensures that appropriate safeguards are in place as required by the Data Privacy Act and NPC regulations, including standard contractual clauses or certification of adequate protection.

7.1 tmt33 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between User devices and tmt33 servers;
• AES-256 encryption at rest for all stored personal data, including KYC documents and financial records;
• Multi-factor authentication (MFA) and role-based access controls for tmt33 staff accessing player data;
• Regular penetration testing and vulnerability assessments by independent security specialists;
• Intrusion detection systems and real-time security monitoring;
• Segregation of personal data from game data in separate secured environments;
• Staff data privacy training and binding confidentiality obligations for all personnel with access to personal data.

7.2 Despite these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. tmt33 takes reasonable precautions consistent with industry standards and applicable Philippine law, but cannot guarantee absolute security of your data.

7.3 You also have a role in protecting your own data: keep your tmt33 account credentials confidential, enable two-factor authentication, log out after each session on shared devices, and notify tmt33 immediately if you suspect unauthorised account access.

8.1 tmt33 retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable Philippine law. Key retention periods are summarised below:

• KYC and identity documents: Retained for a minimum of 5 years following account closure, in compliance with PAGCOR requirements and the AMLA as amended by Republic Act 11521;
• Transaction and financial records: Retained for a minimum of 10 years from the date of the relevant transaction, as required by AMLA;
• Gaming activity data: Retained for 3 years from the date of the activity, after which it is anonymised or deleted;
• Communication records (live chat, support tickets): Retained for 2 years from the date of the last interaction, unless a longer period is required for an ongoing dispute;
• Marketing consent records: Retained for the duration of the User's tmt33 account plus 2 years, as evidence of consent.

8.2 At the end of applicable retention periods, tmt33 will securely delete or anonymise personal data in accordance with NPC-recognised secure disposal methods. Anonymised data that no longer identifies any individual may be retained indefinitely for aggregate analytics purposes.

9.1 Under the Philippine Data Privacy Act of 2012, as a data subject you have the following rights with respect to your personal data held by tmt33:

• Right to Be Informed: You have the right to know what personal data is being collected, why, and how it will be used — which is the purpose of this Privacy Policy;
• Right of Access: You may request a copy of the personal data tmt33 holds about you at any time;
• Right to Rectification: You may request correction of any inaccurate, incomplete, or outdated personal data in your tmt33 account;
• Right to Erasure: You may request deletion of your personal data where tmt33 no longer has a lawful basis to retain it. Note that erasure requests may not be fulfilled where retention is required by law (e.g., AML records);
• Right to Object: You may object to processing of your personal data for direct marketing at any time. You may also object to processing based on legitimate interests, subject to tmt33's overriding legitimate grounds;
• Right to Data Portability: You may request a structured, commonly used, machine-readable copy of your personal data for personal use or transfer to another controller;
• Right to Block or Restrict Processing: You may request that tmt33 restrict processing of your personal data in certain circumstances (e.g., while accuracy is disputed).

9.2 To exercise any of these rights, please contact tmt33 via live chat support or by emailing [email protected]. tmt33 will respond to all verified data subject requests within fifteen (15) calendar days of receipt, as required by the Data Privacy Act. Complex requests may take up to 30 days; tmt33 will notify you if a request requires additional time.

9.3 tmt33 will verify your identity before processing any data subject request to prevent unauthorised disclosure. We will not charge a fee for processing data subject requests unless requests are manifestly unfounded or excessive.

9.4 If you are not satisfied with tmt33's response to a data subject request, or if you believe tmt33 is processing your personal data in violation of the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

10.1 Age verification is conducted during the KYC process using government-issued Philippine identification documents. Any account found to belong to an individual under 21 years of age will be immediately suspended and the account holder's personal data will be processed only to the extent necessary to close the account and comply with applicable regulatory obligations.

10.2 If you believe that tmt33 has inadvertently collected personal data of a person under the age of 21, please contact tmt33's Data Protection Officer (DPO) immediately at [email protected]. tmt33 will investigate and delete any such data promptly.

11.1 tmt33 may send you promotional communications — including information about new games, bonuses, promotions, and platform updates — where you have opted in to receive such communications during registration or in your account preferences.

11.2 You can opt out of marketing communications at any time by: (a) updating your communication preferences in your tmt33 account settings; or (b) contacting tmt33 support via live chat or email and requesting removal from marketing lists. Opt-out requests are processed within 5 business days.

11.3 Opting out of marketing communications does not affect transactional communications necessary for your account — such as deposit confirmations, withdrawal notifications, OTP messages, or security alerts. These communications are sent based on the performance of your account agreement and cannot be disabled.

11.4 tmt33 does not share your contact information with external marketing partners for their own promotional purposes.

12.1 The tmt33 platform may contain references or links to third-party services or information. tmt33 is not responsible for the privacy practices or content of any third-party services. This Privacy Policy applies exclusively to tmt33's own data processing activities.

12.2 tmt33's games are provided by third-party software providers. While tmt33 ensures that its game providers are bound by data protection requirements under contract, tmt33 recommends that Users review the privacy policies of any third-party services they interact with independently of the tmt33 platform.

13.1 tmt33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, platform features, or applicable Philippine law. The "Last updated" date at the top of this document will be revised whenever a change is made.

13.2 For material changes — changes that significantly affect your rights or how your data is used — tmt33 will provide at least 30 days' prior notice via a notification displayed in your tmt33 account, an SMS to your registered mobile number, or a prominent notice on the tmt33 platform. Your continued use of tmt33 following the effective date of a revised Privacy Policy constitutes acceptance of the revised policy.

13.3 You are encouraged to review this Privacy Policy periodically. The most current version is always available at tmt33.org/privacy-policy.

14.1 tmt33 has designated a Data Protection Officer (DPO) as required by the Data Privacy Act. The DPO is responsible for overseeing tmt33's compliance with data privacy obligations and serves as the primary point of contact for data subject rights requests and privacy-related enquiries.

14.2 To contact tmt33's DPO or to submit a data subject rights request, you may use the following channels:

• Live Chat: The fastest channel — available 24/7 directly through the tmt33 platform after logging in. Request to be connected to the Data Privacy team;
• Email: [email protected] — please include "Data Privacy Request" in your subject line and provide your registered mobile number for identity verification.

14.3 For complaints regarding tmt33's privacy practices that are not resolved to your satisfaction by tmt33's DPO, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the government body responsible for enforcing the Data Privacy Act.