sulit77 Privacy Policy

The data controller responsible for the collection and processing of personal data through the sulit77 platform (accessible at sulit77.org) is the licensed operator of sulit77, holding a valid operating licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

The sulit77 data controller is registered and operates under Philippine law. All data processing activities described in this Privacy Policy are conducted in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission of the Philippines.

Questions or requests relating to this Privacy Policy or the handling of your personal data may be directed to the sulit77 Data Protection Officer (DPO) at the contact details provided in Section 15 of this document.

sulit77 collects and processes the following categories of personal data, depending on the nature of your interaction with the platform:

sulit77 does not collect sensitive personal information — including data concerning health, religious beliefs, political affiliations, or criminal records — except where required by PAGCOR regulation or anti-money laundering obligations, in which case it is processed solely for compliance purposes under strict access controls.

sulit77 collects personal data through the following means:

Direct Collection

• Registration: When you create a sulit77 Account, you provide Identity Data and Contact Data directly through the registration form;
• KYC Verification: When you submit identity documents and a selfie as part of the mandatory KYC verification process;
• Cashier Transactions: When you add a payment method, make a deposit, or submit a withdrawal request;
• Support Interactions: When you contact sulit77's customer support via live chat or email;
• Account Settings: When you update your profile, adjust responsible gaming limits, or change communication preferences.

Automated Collection

• Platform Usage: sulit77's systems automatically record Technical Data and Gaming Data as you browse, play, and transact on the platform;
• Cookies and Similar Technologies: As described in Section 9, sulit77 uses cookies to collect session data, analytics, and security information.

Third-Party Sources

• Payment Processors: GCash, PayMaya, BPI, BDO, and Metrobank may share transaction confirmation data with sulit77 to reconcile deposits and withdrawals;
• Identity Verification Services: sulit77 may use regulated third-party KYC verification providers to cross-check identity documents against government databases as required by PAGCOR;
• Fraud Prevention Services: Third-party fraud detection systems may provide risk scores based on Technical Data associated with your session.

sulit77 processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The following table sets out the purposes for which sulit77 processes personal data and the corresponding legal basis:

sulit77 does not sell, rent, or trade your personal data to third parties. Data sharing is limited to the following categories of recipients, each engaged under contractual data processing agreements that require them to maintain equivalent data protection standards:

• PAGCOR and Philippine Regulatory Authorities: sulit77 is required by law to provide player data, transaction records, and gaming logs to PAGCOR upon request and to the Anti-Money Laundering Council (AMLC) where legally required;
• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and Instapay receive the minimum data necessary to process your deposit or withdrawal transactions. sulit77 does not store full payment card numbers;
• KYC and Identity Verification Providers: Regulated third-party providers that verify identity documents as part of the sulit77 KYC process, operating under PAGCOR-approved frameworks;
• Game Providers: sulit77's licensed game providers (slot developers, live casino studios, sports data providers, and sabong operators) receive anonymised session identifiers necessary to deliver and authenticate game sessions. They do not receive your full personal details unless technically required for the specific game type;
• IT Infrastructure and Cloud Service Providers: Server hosting, data storage, and platform infrastructure providers operating under contractual data processor obligations;
• Fraud Prevention and Cybersecurity Services: Third-party services that analyse Technical Data to detect and prevent fraudulent activity, account takeover attempts, and AML-relevant patterns;
• Legal and Professional Advisers: Legal counsel, auditors, and compliance consultants bound by professional confidentiality obligations, where necessary for sulit77's legitimate business and legal compliance purposes.

In all cases, sulit77 shares the minimum data necessary for the specific purpose. Recipients are prohibited from using sulit77 player data for their own marketing or analytics purposes.

Certain sulit77 service providers — including game providers, cloud infrastructure operators, and fraud prevention services — may process personal data in data centres located outside the Philippines. Where personal data is transferred internationally, sulit77 ensures that:

• The transfer is subject to contractual clauses that impose data protection obligations equivalent to those required under the Philippine Data Privacy Act of 2012;
• Where the receiving country does not provide an adequate level of data protection by law, sulit77 implements additional contractual or technical safeguards as required by the National Privacy Commission's cross-border data transfer rules;
• Transfers to game providers are limited to session authentication data and do not include KYC identity documents or financial records;
• Cloud infrastructure providers process data under data processing agreements that restrict sub-processing and impose security, deletion, and audit obligations.

sulit77's primary data infrastructure is located in the Philippines. International transfers are limited to necessary technical integrations with certified third-party service providers and are not conducted to circumvent Philippine data protection requirements.

sulit77 retains personal data for as long as necessary to fulfil the purposes for which it was collected and to comply with legal and regulatory obligations. The following retention standards apply:

Upon expiry of the applicable retention period, sulit77 will securely delete or anonymise the personal data in question. Where deletion is technically infeasible within a standard timeframe due to backup architecture, the data will be isolated from active processing and deleted at the next available scheduled purge cycle.

Under the Data Privacy Act of 2012 (Republic Act 10173), sulit77 account holders and data subjects resident in the Philippines hold the following rights with respect to their personal data:

• Right to be Informed: You have the right to be informed of the nature, purpose, and extent of processing of your personal data before collection and upon any material change to processing activities;
• Right to Access: You may request a copy of the personal data sulit77 holds about you, information on how it is being used, and the identities of third parties with whom it has been shared;
• Right to Rectification: You may request correction of any inaccurate or outdated personal data held by sulit77. You can update most account information directly through Account Settings;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to sulit77's legal retention obligations under PAGCOR regulation and the Anti-Money Laundering Act;
• Right to Data Portability: You may request a copy of personal data you have provided to sulit77 in a structured, commonly used, and machine-readable format;
• Right to Object: You may object to sulit77's processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interest where your individual circumstances justify this;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe sulit77 has processed your personal data in breach of the Data Privacy Act.

sulit77 uses cookies and similar technologies on its platform to ensure correct platform operation, maintain session security, support analytics, and where you have consented, to serve relevant promotional content.

Types of Cookies Used by sulit77

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that maintain your sulit77 login state, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without affecting platform operation;
• Performance and Analytics Cookies: Used to understand how players use the sulit77 platform — which game categories are visited most often, where technical errors occur, and how the lobby navigation performs. This data is collected in aggregated, pseudonymised form;
• Functionality Cookies: Remember your language preferences, responsible gaming settings, and other personalisation options to improve your experience across sessions;
• Marketing Cookies: Used only where you have given explicit consent. These cookies may track your interaction with sulit77 promotional content to help sulit77 optimise the relevance and timing of promotional communications.

Most browsers allow you to manage and delete cookies through browser settings. Blocking strictly necessary cookies will impair sulit77 platform functionality. Blocking other cookie types will not affect your ability to play games or transact on sulit77 but may affect personalisation features. sulit77's cookie consent notice displayed on your first platform visit allows you to manage non-essential cookie categories.

sulit77 strictly prohibits the use of its platform by any individual under the age of 21 years, consistent with the age requirement for casino-style gaming established by the Philippine Amusement and Gaming Corporation (PAGCOR).

sulit77 does not knowingly collect personal data from individuals under 21 years of age. All account registrations are subject to mandatory KYC identity verification that confirms the player's age before full account activation. Where sulit77 becomes aware that personal data has been collected from an individual under 21 — whether through erroneous registration or circumvention of age verification — the following steps will be taken immediately:

• The Account will be permanently closed;
• All personal data associated with the Account will be securely deleted, subject only to any retention obligations required by law for AML or fraud investigation purposes;
• Any Real Money Balance in the Account will be returned to the verified payment method after AML checks;
• All Bonus Funds and any winnings derived from Bonus Funds will be forfeited.

sulit77 implements a combination of technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include but are not limited to:

Technical Safeguards

• 256-bit TLS/SSL encryption on all data transmitted between your browser or device and sulit77's servers;
• AES-256 encryption for sensitive personal data stored at rest, including KYC documents and financial records;
• Multi-factor authentication requirements for internal sulit77 staff systems that access personal data;
• Automated intrusion detection and anomalous login monitoring across the platform;
• Regular third-party penetration testing and vulnerability assessments;
• Web Application Firewall (WAF) protection on all externally facing sulit77 systems.

Organisational Safeguards

• Role-based access controls limiting data access to sulit77 personnel who require it for their specific job function;
• Mandatory data privacy and security training for all sulit77 staff with access to personal data;
• Contractual data processing obligations for all third-party service providers handling sulit77 player data;
• A documented Data Breach Response Plan reviewed at least annually.

No security system is impenetrable. While sulit77 applies industry-standard security practices, it cannot guarantee absolute security against all possible attacks or data incidents. Players are encouraged to enable two-factor authentication on their sulit77 Account to provide an additional layer of personal account security.

In the event of a personal data breach that poses a risk to the rights and freedoms of affected data subjects, sulit77 will comply with the notification obligations established under the Data Privacy Act of 2012 and the National Privacy Commission's breach notification regulations:

• Internal Response: Upon detection or reasonable suspicion of a data breach, sulit77's incident response team will initiate immediate containment, assessment, and evidence preservation procedures;
• Regulatory Notification: sulit77 will notify the National Privacy Commission within 72 hours of becoming aware of a breach likely to result in harm to data subjects, in accordance with NPC Circular 16-03 and subsequent issuances;
• Player Notification: Where a breach is likely to result in a high risk to the rights of affected sulit77 account holders, sulit77 will notify those individuals without undue delay, describing the nature of the breach, the data involved, the likely consequences, and the steps sulit77 has taken or proposes to take to address the breach;
• Documentation: All breaches — whether or not they require regulatory notification — will be documented in sulit77's internal breach register maintained by the Data Protection Officer.

Players who suspect that their sulit77 Account has been compromised or that their personal data may have been accessed without authorisation should contact sulit77's support team immediately through the 24/7 live chat function.

The sulit77 platform may contain references or contextual links to third-party services, including payment providers such as GCash and PayMaya. When you leave the sulit77 platform and access a third-party website or application, sulit77's Privacy Policy no longer applies to your data interactions on that third-party platform.

sulit77 does not control the data practices of third-party platforms and is not responsible for their privacy policies or data handling procedures. Players should review the privacy policy of any third-party platform they access — including payment providers — independently. sulit77 recommends reviewing the privacy policies of GCash, PayMaya, and any banking application you use in connection with your sulit77 transactions.

sulit77 does not receive browsing data from third-party websites that you visit before or after accessing sulit77, except where a third-party payment processor shares transaction confirmation data as part of the deposit or withdrawal reconciliation process described in Section 5.

sulit77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, National Privacy Commission guidance, or PAGCOR regulatory requirements. The version and effective date at the top of this document will be updated whenever material changes are made.

Where changes are material — meaning they significantly affect how sulit77 uses your personal data or the rights available to you — sulit77 will provide advance notice by one or more of the following methods prior to the change taking effect:

• A prominent notice on the sulit77 website homepage;
• An email notification to the registered email address on your Account;
• An in-platform notification upon your next login to sulit77.

Non-material changes — such as clarifications of existing language, corrections of typographical errors, or updates to contact information — will take effect upon publication without prior notice. Your continued use of the sulit77 platform following any privacy policy update constitutes acknowledgement of the updated policy. If you do not agree to the updated policy, please cease using the platform and request Account closure.

sulit77 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO is the appropriate point of contact for all Data Subject Access Requests, privacy complaints, and data breach notifications from players.

• Data Protection Officer, sulit77
• Email: [email protected] — Please mark the subject line as "Data Privacy Request" or "Attention: DPO";
• Live Chat: Available 24/7 through the sulit77 website — for urgent privacy or security concerns, live chat provides the fastest response;
• Response Commitment: Acknowledgement within 3 business days; substantive response within 15 business days.

Where you are not satisfied with sulit77's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.