twinkaboo Privacy Policy

1 Introduction

twinkaboo ("we," "us," "our") operates the online gaming platform accessible at twinkaboo.club under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR). As part of operating this platform for Filipino players, we necessarily collect, process, store, and transmit personal information.

This Privacy Policy describes our practices with respect to personal data — what we collect, why we collect it, how it is used and protected, and the rights available to you as a data subject under Philippine law. This Policy applies to all personal data processed in connection with your registration, use of the twinkaboo platform, and any communication you have with twinkaboo's support team.

By registering a twinkaboo account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how twinkaboo processes personal data as described here, you should not register an account or use the Platform.

2 Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act 10173), twinkaboo is the Personal Information Controller (PIC) with respect to all personal data collected through the twinkaboo platform and its related services. As PIC, twinkaboo determines the purposes and means of processing your personal information and is accountable for ensuring that processing complies with applicable data protection law.

twinkaboo has designated a Data Protection Officer (DPO) responsible for overseeing compliance with data privacy obligations. The DPO can be contacted through twinkaboo's support channel at support at twinkaboo.club with the subject line "Data Privacy / DPO Inquiry."

3 Personal Data We Collect

twinkaboo collects only the personal data necessary for the specific purposes described in this Policy. The categories of personal data we collect are set out in the table below:

twinkaboo does not intentionally collect sensitive personal information beyond what is necessary for KYC compliance (specifically, government ID information required by PAGCOR regulations). We do not collect health data, religious beliefs, political affiliations, or similar categories of sensitive data.

4 How We Collect Personal Data

twinkaboo collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, add a payment method, contact support, or update your account settings;
• Automatically through your use of the Platform — including IP address, device information, session data, game activity logs, and browser cookies when you access the twinkaboo website or web application;
• From payment service providers — GCash, PayMaya, and linked bank accounts provide transaction confirmation data to facilitate deposit and withdrawal processing;
• From fraud prevention and identity verification services — third-party KYC verification partners may cross-reference submitted documents against identity databases as part of the verification process;
• From regulatory authorities — in specific circumstances required by PAGCOR or other competent Philippine regulatory authorities.

5 How We Use Your Personal Data

5.1 Account Management

twinkaboo uses your registration data to create and maintain your player account, authenticate your identity at login, manage your account settings, and communicate with you regarding account-related matters including security alerts, KYC status updates, and transaction confirmations.

5.2 Payment Processing

Your financial data is used to process deposit and withdrawal transactions via GCash, PayMaya, BPI, BDO, and Metrobank. twinkaboo retains transaction records for a minimum of five (5) years as required by the Anti-Money Laundering Act (Republic Act 9160, as amended). Payment method details are stored in encrypted format and are not transmitted to third parties except as necessary to execute the specific transaction requested.

5.3 Identity Verification and Regulatory Compliance

KYC documents are processed to verify your identity in compliance with PAGCOR licensing requirements and AMLA obligations. twinkaboo is required to confirm that all players are real individuals, of legal gaming age (21+), and not subject to any exclusion order or regulatory prohibition. KYC data is retained for the duration of your account plus five (5) years following account closure, in accordance with AMLA record-keeping requirements.

5.4 Responsible Gaming Monitoring

Gaming activity data — including bet sizes, session lengths, win/loss patterns, and deposit frequency — is analyzed to identify behavioral indicators of problem gambling. Where such indicators are detected, twinkaboo may initiate a welfare contact, impose responsible gaming interventions, or refer the Player to support resources. This processing is carried out in fulfillment of twinkaboo's PAGCOR-mandated responsible gaming obligations and is not used for commercial profiling purposes.

5.5 Fraud Prevention and Security

Technical data including IP addresses, device fingerprints, and session logs are used to detect and prevent fraudulent activity, unauthorized account access, multiple account creation, bonus abuse, and other prohibited conduct as defined in the twinkaboo Terms and Conditions. This processing is essential for platform integrity and the protection of all players.

5.6 Marketing Communications

Where you have provided explicit consent, twinkaboo may use your email address and mobile number to send promotional communications — including bonus offers, game launch announcements, and VIP program updates. Marketing communications are sent only to players who have opted in and can be stopped at any time by updating your preferences in account settings or by contacting support.

5.7 Platform Improvement and Analytics

Aggregated and anonymized usage data is used to analyze platform performance, identify technical issues, optimize the user experience, and inform product development decisions. This analytics processing uses de-identified data that cannot be linked back to individual players.

6 Legal Basis for Processing

Under the Philippine Data Privacy Act, twinkaboo's processing of personal data is founded on the following legal bases:

• Contract performance — processing necessary to operate your account, process transactions, and deliver the gaming services you have registered for;
• Legal obligation — processing required to comply with PAGCOR licensing conditions, AMLA reporting obligations, and other applicable Philippine law;
• Legitimate interests — processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests do not override your fundamental privacy rights;
• Consent — processing for marketing communications, which requires your explicit prior consent and may be withdrawn at any time.

7 Data Sharing and Third-Party Disclosure

7.1 Regulatory Authorities

twinkaboo shares personal data with PAGCOR and, where required, with the Anti-Money Laundering Council (AMLC) of the Philippines, as mandated by our operating license and by law. These disclosures are strictly limited to what is legally required and are not subject to player consent withdrawal — they are non-negotiable obligations of our licensed operation.

7.2 Payment Service Providers

Transaction data is shared with GCash (G-Xchange, Inc.), PayMaya (PayMaya Philippines, Inc.), and partner banks (BPI, BDO, Metrobank) solely for the purpose of processing your deposit and withdrawal transactions. These providers process data under their own privacy policies and applicable Philippine financial regulations. twinkaboo does not share data with payment providers beyond what is required for transaction execution.

7.3 KYC Verification Partners

twinkaboo may engage certified third-party KYC verification service providers to assist with identity document verification. These providers are contractually bound to process KYC data only for the purpose of identity verification on twinkaboo's behalf and are prohibited from using the data for any other purpose.

7.4 Technology and Infrastructure Providers

twinkaboo uses third-party cloud infrastructure, cybersecurity, and platform technology providers in the course of operating the Platform. These providers process data as data processors acting under twinkaboo's instructions and are contractually bound to implement appropriate security measures and to use the data only as directed.

7.5 No Commercial Data Sales

twinkaboo does not sell, rent, license, or otherwise transfer your personal data to third parties for their own marketing, commercial, or analytical purposes. This prohibition applies without exception.

8 Data Retention

twinkaboo retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal minimum retention periods. The following retention periods apply:

• Active account data (registration data, account settings, gaming history): retained for the duration of your active account;
• KYC documents: retained for the duration of your account plus a minimum of five (5) years following account closure, as required by AMLA;
• Financial transaction records: retained for a minimum of five (5) years following each transaction, as required by AMLA and PAGCOR regulations;
• Support communications: retained for three (3) years following the resolution of the interaction, for dispute resolution and quality assurance purposes;
• Marketing consent records: retained for the duration of the marketing relationship plus three (3) years following consent withdrawal, as evidence of lawful processing;
• Technical and security logs: retained for twelve (12) months, after which they are automatically deleted unless a security investigation requires longer retention.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with twinkaboo's data disposal procedures.

9 Data Security

twinkaboo implements technical and organizational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the twinkaboo platform;
• AES-256 encryption for personal data and KYC documents stored at rest on twinkaboo servers;
• Role-based access controls limiting personal data access to authorized personnel with a documented business need;
• Comprehensive audit logging of all access to sensitive personal data;
• Regular security vulnerability assessments and penetration testing;
• Two-factor authentication requirements for administrative access to data systems;
• Employee data privacy training and confidentiality obligations for all staff with access to personal data.

In the event of a personal data breach that is likely to result in harm to affected data subjects, twinkaboo will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach and will notify affected Players without undue delay, in accordance with the breach notification requirements of the Data Privacy Act and NPC Circular 16-03.

10 Cookies and Tracking Technologies

The twinkaboo platform uses cookies and similar tracking technologies to operate essential platform functions, maintain your login session, and collect analytics data. The categories of cookies used are:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without preventing the platform from functioning correctly.
• Functional Cookies: Cookies that remember your preferences — such as language settings, last-played games, and responsible gaming limits — to improve your experience. These can be disabled, but doing so may affect platform functionality.
• Analytics Cookies: Cookies used to collect aggregated and anonymized data about how players use the platform. This data helps twinkaboo improve the platform's performance and user experience. Analytics cookies do not contain personally identifiable information.
• Security Cookies: Cookies used for fraud detection and platform security purposes, including device fingerprinting used to detect multiple account attempts.

twinkaboo does not use third-party advertising or tracking cookies that monitor your behavior across other websites. Cookie preferences can be managed through your browser settings; however, disabling strictly necessary cookies will prevent you from using the platform.

11 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by twinkaboo:

• Right to be Informed: The right to be notified of how your personal data is being processed — which this Privacy Policy fulfills;
• Right of Access: The right to obtain confirmation of whether twinkaboo holds personal data about you and, if so, to receive a copy of that data;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held about you;
• Right to Erasure: The right to request deletion of personal data in certain circumstances — note that data subject to legal retention obligations (e.g., AMLA records) cannot be deleted before the applicable retention period expires;
• Right to Object: The right to object to specific types of processing, particularly direct marketing, where processing is based on consent or legitimate interests;
• Right to Data Portability: The right to receive a copy of data you have provided to twinkaboo in a commonly used electronic format;
• Right to Complain: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe twinkaboo has processed your data unlawfully.

12 Children's Privacy and Underage Player Protection

The twinkaboo platform is strictly restricted to individuals who are 21 years of age or older, in accordance with PAGCOR licensing requirements applicable to online casino-style gaming in the Philippines. twinkaboo does not knowingly collect personal information from individuals under 21 years of age.

Age is verified through the KYC process required before withdrawal access is granted. Where twinkaboo discovers that an account has been created by or on behalf of an individual under 21 years of age, the account will be immediately terminated, all balances forfeited, and any personal data associated with the account deleted except where retention is required by law.

If you believe that an individual under 21 years of age has registered a twinkaboo account, please contact our support team immediately. We take underage gambling prevention extremely seriously and will act on such reports without delay.

13 Cross-Border Data Transfers

twinkaboo's primary data processing infrastructure is located within or as close as operationally feasible to the Philippines. In the course of operating the Platform, certain technical service providers — including cloud infrastructure partners and cybersecurity vendors — may be located in other countries.

Where personal data is transferred outside the Philippines, twinkaboo ensures that appropriate safeguards are in place in compliance with the Data Privacy Act and applicable NPC regulations. These safeguards include contractual data processing agreements that impose equivalent data protection standards on overseas processors and prohibit unauthorized use or disclosure of transferred data.

twinkaboo does not transfer KYC documents or sensitive financial data to processors in jurisdictions with inadequate data protection standards without implementing additional appropriate safeguards.

14 Updates to This Privacy Policy

twinkaboo reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or operational changes to the Platform. Material updates — those that meaningfully change how we process your personal data or affect your rights — will be communicated to registered Players via email at least fourteen (14) days before the changes take effect.

The date of the most recent revision to this Policy is displayed at the top of this page. Your continued use of the twinkaboo platform after the effective date of any Policy update constitutes acceptance of the updated terms. We encourage you to review this Policy periodically.

If a policy update requires your fresh consent — for example, if we introduce a new category of processing that is based on consent — we will seek that consent explicitly before proceeding with the new processing activity.

15 Contact and Privacy Complaints

For questions, requests, or concerns regarding this Privacy Policy or twinkaboo's data processing practices, please contact us through any of the following channels:

If you are not satisfied with twinkaboo's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government agency responsible for administering and enforcing the Data Privacy Act and can receive formal complaints from data subjects whose rights have been violated. Information on filing a complaint with the NPC is available through official Philippine government channels.

twinkaboo is also subject to PAGCOR's oversight as a licensed operator. Players may raise data-related concerns with PAGCOR where they relate to twinkaboo's compliance with PAGCOR regulations on player data protection.