ric9 Casino
Privacy Policy

This Privacy Policy ("Policy") describes how ric9 ("ric9", "we", "us", "the Platform", "the Company") collects, uses, stores, processes, and protects the personal data of individuals ("you", "Data Subject", "Player") who access or use the online casino and sports betting platform available at ric9.club.

ric9 is fully committed to protecting your privacy and handling your personal data in a transparent, lawful, and accountable manner, in strict compliance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC).

This Policy should be read together with the ric9 Terms & Conditions, which also form part of the agreement between you and ric9. Where this Policy conflicts with the Terms & Conditions on a privacy matter, this Policy shall take precedence.

For the purposes of the Data Privacy Act of 2012, ric9 acts as the Personal Information Controller (PIC) in respect of all personal data collected from players and users of the Platform. This means ric9 determines the purposes and means of processing your personal data.

ric9 has designated a Data Protection Officer (DPO) responsible for overseeing the Company's data protection compliance programme, handling data subject requests, and serving as the point of contact with the National Privacy Commission. The DPO may be contacted at: [email protected] (please include "Data Privacy" in the subject line of your message).

ric9 collects the following categories of personal data from players and users of the Platform:

ric9 collects personal data through the following channels:

• Direct submission: Data you provide when registering for a ric9 account, completing KYC verification, making deposits or withdrawals, contacting support, or responding to surveys;
• Automated collection: Technical data collected automatically when you access the Platform, including through cookies, web beacons, session tracking, and server log files;
• Payment providers: Transaction confirmation data shared by GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors when you initiate financial transactions on ric9;
• Identity verification providers: Verification results returned by third-party KYC and identity document verification services engaged by ric9 for regulatory compliance;
• Regulatory sources: Screening results from sanctions lists, PEP databases, and other sources mandated by Philippine AML legislation;
• Third-party analytics: Aggregated, anonymised usage data from analytics services used to improve Platform performance and user experience.

ric9 processes your personal data only for specified, legitimate purposes. The primary purposes and their legal bases under RA 10173 are set out below:

ric9 does not process your personal data for any purpose incompatible with those listed above without first obtaining your renewed consent or establishing a new legal basis. ric9 does not sell your personal data to any third party for commercial marketing purposes.

ric9 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment processors: GCash (Mynt), PayMaya (PayMongo/VOYAGER), BPI, BDO, and Metrobank — to process deposits and withdrawals in PHP;
• KYC and identity verification providers: Third-party services engaged for PAGCOR-mandated identity and age verification;
• Game and platform providers: JILI Technology, PG Soft, Pragmatic Play, and other licensed game providers — limited to session data necessary for game delivery;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission, where required by Philippine law;
• Law enforcement: Philippine law enforcement authorities or courts, pursuant to a valid legal order;
• Professional advisers: Legal counsel, external auditors, and compliance consultants bound by confidentiality obligations;
• IT and infrastructure providers: Cloud hosting and cybersecurity service providers operating ric9's technical infrastructure, bound by data processing agreements.

ric9 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods mandated by Philippine law and PAGCOR regulations:

• Account and KYC records: Minimum five (5) years from account closure, as required by PAGCOR licensing conditions and RA 9160 (Anti-Money Laundering Act);
• Financial transaction records: Minimum five (5) years from the date of each transaction, in compliance with RA 9160 and Bureau of Internal Revenue (BIR) requirements;
• Communication and support records: Three (3) years from the date of communication, unless required to be retained longer in connection with an unresolved dispute;
• Technical logs (IP address, session data): Ninety (90) days, unless required to be retained longer for an active investigation or regulatory inquiry;
• Marketing preference records: Until withdrawal of consent plus twelve (12) months for audit purposes.

Upon expiry of the applicable retention period, ric9 will securely destroy or permanently anonymise your personal data in accordance with data destruction procedures approved by the Company's Data Protection Officer.

ric9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and ric9's servers — the same standard used by Philippine banks for online transactions;
• AES-256 encryption at rest for all personally identifiable data stored in ric9's databases;
• Bcrypt hashing for all account passwords — ric9 never stores passwords in plain text and cannot retrieve your password (only reset it);
• Two-factor authentication (2FA) available to all players for additional login security;
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by qualified cybersecurity professionals;
• 24/7 security monitoring of ric9's infrastructure for anomalous activity and potential data breaches;
• Data breach response procedures aligned with the NPC's mandatory breach notification requirements under RA 10173.

While ric9 maintains robust security controls, no online system can guarantee absolute security. In the event of a personal data breach that poses a real risk to data subjects, ric9 will notify the National Privacy Commission and affected players within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by ric9. To exercise any of these rights, contact our Data Protection Officer at [email protected] with your request and sufficient identification. ric9 will respond within fifteen (15) business days.

ric9 uses cookies and similar tracking technologies on ric9.club to provide essential Platform functionality, improve user experience, and analyse Platform performance. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function — including session management, ric9 login authentication, and security controls. These cannot be disabled without rendering the Platform unusable;
• Functional cookies: Remember your preferences such as language settings, game lobby layout, and display options to improve your session experience;
• Analytics cookies: Collect anonymised or aggregated data about how players navigate the Platform, which pages are visited most, and where technical errors occur — used to improve Platform quality;
• Security cookies: Detect and prevent fraudulent activity, bot access, and account takeover attempts.

You may control non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in to and use ric9. ric9 does not use third-party advertising cookies or cross-site tracking cookies on its Platform.

ric9 does not knowingly collect personal data from individuals under the age of 21 years. The PAGCOR-mandated minimum age for participation in casino-style gaming in the Philippines is 21, and ric9 enforces this requirement through mandatory identity and age verification during the KYC process.

If you are the parent or guardian of a minor and believe that your child has provided personal data to ric9, please contact our Data Protection Officer immediately at [email protected].

In the course of providing the Platform and its associated services, personal data may be transferred to and processed by ric9's service providers and game providers operating in jurisdictions outside the Republic of the Philippines. Such transfers may occur for the purposes of platform hosting, identity verification, game delivery, and technical support.

In compliance with Section 21 of the Data Privacy Act of 2012, ric9 ensures that any cross-border transfer of personal data is subject to appropriate safeguards, including contractual clauses requiring the recipient to provide an equivalent level of data protection as required under Philippine law. ric9 does not transfer personal data to jurisdictions that the NPC has identified as inadequate for data protection purposes without implementing additional protective measures.

ric9 reserves the right to update this Privacy Policy at any time to reflect changes in applicable Philippine law, NPC guidelines, PAGCOR regulatory requirements, or ric9's data processing practices. When material changes are made — meaning changes that substantially affect your rights as a data subject or the way your personal data is processed — ric9 will notify you by email to the address on your registered ric9 account at least fourteen (14) days before the changes take effect.

The effective date at the top of this page will always reflect when the current version of the Policy came into force. ric9 recommends that you review this Policy periodically. Your continued use of the Platform after the effective date of any change constitutes your acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ric9, please contact the ric9 Data Protection Officer through the following channels:

• Email (DPO): [email protected] — please include "Data Privacy Request" in the subject line;
• Live Chat: Available 24/7 from within your logged-in ric9 account — suitable for general privacy questions;
• Response Time: ric9 will acknowledge all data subject requests within five (5) business days and provide a full response within fifteen (15) business days, extendable by a further thirty (30) days for complex requests with prior notification.

If you are not satisfied with ric9's response to your privacy inquiry or data subject request, you have the right to escalate your complaint to the National Privacy Commission of the Philippines — the government body responsible for enforcing the Data Privacy Act of 2012.