nunsta Privacy Policy

At nunsta, we take our obligations under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations seriously. As a PAGCOR-regulated online casino and sports betting platform serving Filipino players, we handle sensitive personal information — and we are committed to doing so with transparency, integrity, and genuine respect for your privacy. This Privacy Policy is our binding commitment to you on how that data is handled.

Data Controller

The data controller responsible for your personal information collected through the nunsta platform (accessible at nunsta.net) is nunsta, a PAGCOR-licensed online gaming operator based in the Philippines.

As data controller, nunsta determines the purposes for which your personal data is processed and the means by which that processing is carried out. nunsta has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. Contact details for the DPO are provided in Section 14 of this policy.

Where nunsta engages third-party service providers to process personal data on its behalf — such as payment processors (GCash, Maya, BPI, BDO), KYC verification providers, or cloud infrastructure providers — those providers act as data processors under written agreements that impose data protection obligations consistent with this policy and applicable Philippine law.

Scope & Application

This Privacy Policy applies to:

• All personal data collected from registered nunsta Account holders (players).
• Personal data collected from individuals who visit the nunsta website or mobile platform without registering an Account, including through cookies and device identifiers.
• Personal data received from third parties in connection with your use of the nunsta platform, such as KYC verification data from identity verification providers.
• Personal data shared by you with nunsta through customer support channels, live chat, email correspondence, or promotional participation.

This policy does not apply to the data practices of third-party payment providers, game content providers, or other external services that you may interact with in connection with your nunsta Account. Those parties operate under their own privacy policies, and nunsta encourages you to review those policies independently.

What We Collect

nunsta collects the following categories of personal data, depending on your interactions with the platform:

How We Collect Data

nunsta collects personal data through the following means:

• Directly from you — when you register for an Account, complete KYC verification, make deposits or withdrawals, place wagers, contact customer support, or participate in promotions.
• Automatically — when you access and interact with the nunsta platform, through server logs, session tracking technology, and cookies. See Section 10 for full details on cookies and tracking technologies.
• From third-party KYC providers — identity verification results, document authenticity checks, and liveness check outcomes are transmitted to nunsta by our accredited KYC verification partner following your consent to that verification process.
• From payment processors — GCash, Maya, BPI, BDO, UnionBank, and other payment providers transmit transaction confirmation data to nunsta. Full payment card or account numbers are never stored by nunsta; we receive only masked references sufficient to reconcile your Account.
• From PAGCOR and AMLC — nunsta may receive information from the Philippine Amusement and Gaming Corporation or the Anti-Money Laundering Council in connection with regulatory compliance obligations. Such data is used solely for compliance purposes.

Why We Use Your Data

nunsta processes your personal data for the following purposes:

1. Account Registration and Management — to create, maintain, and administer your nunsta Account, including authentication, Account recovery, and Account closure.
2. KYC and Age Verification — to verify your identity, confirm you are aged 21 or above (as required by Philippine gambling law), and ensure you are not a self-excluded player or a person on any applicable exclusion register.
3. Payment Processing — to process deposits and withdrawals, reconcile financial transactions, and maintain accurate Account balance records in Philippine Pesos.
4. Gaming Services — to operate casino games and sports betting markets, record game outcomes, calculate and credit winnings, and provide an accurate betting history to you.
5. AML and Fraud Prevention — to monitor transactions and gameplay patterns for indicators of money laundering, fraud, collusion, or other prohibited conduct, and to comply with Covered Transaction Report (CTR) and Suspicious Transaction Report (STR) filing obligations under the Anti-Money Laundering Act.
6. Responsible Gaming — to enforce your chosen deposit limits, session reminders, cool-down periods, and self-exclusion settings; to monitor gameplay for indicators of problem gambling; and to comply with PAGCOR responsible gaming programme requirements.
7. Customer Support — to respond to your queries, resolve disputes, and maintain records of support interactions for quality assurance and regulatory accountability.
8. Legal and Regulatory Compliance — to comply with PAGCOR licensing requirements, the Data Privacy Act, the Anti-Money Laundering Act, the Anti-Terrorism Financing Act, and any other applicable Philippine law or regulation.
9. Marketing Communications — to send you promotional offers, bonus notifications, and platform updates by email or SMS, but only where you have expressly opted in to receive such communications. You may withdraw this consent at any time.
10. Platform Improvement — to analyse aggregated and anonymised usage data to improve platform performance, game offerings, and the overall player experience.

Legal Basis for Processing

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, nunsta processes your personal data on the following legal bases:

Sharing Your Data

nunsta does not sell your personal data. nunsta does not share your personal data with third parties for their own marketing purposes. Personal data is shared only in the following circumstances:

• Payment Processors: GCash, Maya, BPI, BDO, UnionBank, Metrobank, 7-Eleven payment network, USDT infrastructure providers, and Coins.ph receive transaction data strictly necessary to process your deposits and withdrawals. These providers are independently regulated and operate under their own privacy frameworks.
• KYC Verification Providers: Our accredited identity verification partner receives your KYC documents and returns a verification result to nunsta. Document data is processed under a written data processing agreement that restricts use to the verification purpose only.
• Game Content Providers: Third-party game providers whose titles are available on the nunsta platform receive a session token and may log game outcome data. Personal identity data is not shared with game providers.
• PAGCOR: nunsta is obligated by its PAGCOR licence to provide player data, transaction records, and gaming activity reports to PAGCOR on a periodic and on-demand basis for regulatory supervision purposes.
• Anti-Money Laundering Council (AMLC): nunsta files Covered Transaction Reports and Suspicious Transaction Reports with the AMLC as required by the Anti-Money Laundering Act of 2001 (as amended). This may include your identity data and transaction history.
• Law Enforcement and Courts: nunsta will disclose personal data to Philippine law enforcement agencies or courts where required to do so by a valid legal order, warrant, or subpoena.
• Cloud Infrastructure Providers: nunsta's platform is hosted on cloud infrastructure. Our infrastructure provider acts as a data processor under a written agreement and stores data on servers in jurisdictions that maintain adequate data protection standards.

Retention Periods

nunsta retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to mandatory retention obligations under Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised, whichever is technically appropriate. Anonymised, aggregated data may be retained indefinitely for statistical and platform improvement purposes, as it no longer constitutes personal data.

Security Measures

nunsta implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All communications between your browser or app and the nunsta platform are encrypted using TLS 1.3. Older, insecure protocol versions (TLS 1.0, TLS 1.1, SSL) are disabled.
• Encryption at Rest: Personal data and financial records stored in nunsta's databases are encrypted at rest using AES-256 encryption.
• Password Security: Account passwords are hashed using bcrypt with an adaptive work factor. nunsta never stores plaintext passwords and can never retrieve your password — only reset it.
• Two-Factor Authentication (2FA): SMS OTP-based 2FA is required for all withdrawal requests and is strongly recommended for all Account logins. Authenticator app-based 2FA is also supported.
• Access Controls: Access to personal data within nunsta's internal systems is restricted on a need-to-know basis and governed by role-based access controls. Staff with access to sensitive player data undergo background checks and are bound by confidentiality obligations.
• Intrusion Detection and Monitoring: nunsta operates real-time security monitoring, automated anomaly detection, and a 24/7 security operations process to detect and respond to potential security incidents.
• Penetration Testing: nunsta engages independent security professionals to conduct periodic penetration testing of the platform. Critical findings are remediated within 72 hours of identification.
• Data Breach Response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, nunsta will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, as required by the Data Privacy Act of 2012.

Cookies & Tracking Technologies

nunsta uses cookies and similar tracking technologies on the nunsta platform. A cookie is a small text file placed on your device by a website. nunsta uses the following categories of cookies:

nunsta does not use third-party advertising cookies, behavioural profiling cookies, or social media tracking pixels. nunsta does not serve or permit third-party advertisements on the platform.

You may manage your cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will affect platform functionality and may prevent you from logging in. Disabling functional or analytics cookies will not affect your ability to play or transact.

Your Rights Under the Data Privacy Act

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights with respect to your personal data held by nunsta. To exercise any of these rights, contact nunsta's Data Protection Officer using the details in Section 14.

All data rights requests must be submitted in writing to nunsta's DPO. nunsta will verify your identity before processing any request that discloses, modifies, or deletes personal data, to prevent unauthorised access to another person's information.

Minors & Age Policy

The nunsta platform is strictly intended for individuals aged 21 years and above, in accordance with Philippine gambling regulations. nunsta does not knowingly collect personal data from individuals under the age of 21.

If nunsta discovers, through KYC verification or any other means, that an Account has been registered by or on behalf of a person under 21, that Account will be immediately closed and any deposits will be returned to the originating payment account. No wagers placed on such an Account will be honoured.

If you are a parent or guardian and believe that a minor has registered on the nunsta platform without your knowledge, please contact nunsta support immediately at the details in Section 14. nunsta will investigate and act on the report within 24 hours.

Policy Changes

nunsta may update this Privacy Policy from time to time to reflect changes in our data practices, applicable Philippine law, or PAGCOR regulatory requirements. The "Effective Date" at the top of this page will be updated each time a revision is made.

Where a material change is made to this Privacy Policy — such as a new category of data being collected, a new third party receiving your data, or a change to your rights — nunsta will provide at least 7 days' advance notice by posting the updated policy on this page and, where practicable, by sending a notification to your registered email address or via an in-platform notification banner.

Your continued use of the nunsta platform after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated policy. If you do not accept the changes, you may request Account closure and data erasure (subject to mandatory retention obligations) as described in Section 11.

nunsta maintains an archive of prior versions of this Privacy Policy. If you wish to review a prior version — for example, in connection with a data processing complaint relating to a past period — contact the DPO with your request.

Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights, please contact nunsta's designated Data Protection Officer:

nunsta aims to respond to all data rights requests and privacy inquiries within 15 business days of receipt. For urgent matters — such as suspected unauthorised access to your Account or a data breach concern — please use the 24/7 live chat channel for the fastest response.

If you are not satisfied with nunsta's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent authority responsible for enforcing the Data Privacy Act of 2012.