aha888 Privacy Policy

This Privacy Policy ("Policy") is issued by aha888 and applies to all personal data collected and processed in connection with your use of the aha888 online gaming platform, accessible at https://aha888.co ("Platform"), and all associated services, features, and communications.

aha888 operates under applicable Philippine law, including Republic Act 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations. This Policy describes our practices as a Personal Information Controller (PIC) as defined under Philippine data privacy legislation.

This Policy applies to:

• All registered Players who hold an active aha888 Account
• Visitors to the aha888 Platform who have not yet registered
• Former Players whose data is retained in accordance with Section 10 of this Policy
• Individuals who contact aha888 via any support channel

By accessing the aha888 Platform and registering an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must immediately cease using the Platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, aha888 acts as the Personal Information Controller in respect of all personal data collected through the Platform.

aha888 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable Philippine data privacy regulations. The DPO may be reached via the contact details set out in Section 16 of this Policy.

Where aha888 engages third-party service providers to process personal data on our behalf (for example, KYC verification providers or payment processors), those third parties act as Personal Information Processors under binding data processing agreements that prohibit use of your data for any purpose beyond the specific service contracted.

aha888 collects the following categories of personal data from Players, in accordance with the principle of data minimisation:

aha888 collects personal data through the following channels and methods:

4.1 Direct Collection

• Account Registration: Information you provide when creating your aha888 Account, including name, date of birth, and Philippine mobile number.
• KYC Verification: Government-issued identification documents and supporting documents you upload through the Account verification portal.
• Cashier Transactions: Payment method details you submit when making deposits or requesting withdrawals via GCash, Maya, or bank transfer.
• Customer Support: Information you provide when contacting aha888 support via email or in-Platform messaging.
• Responsible Gaming Tools: Preferences and restrictions you voluntarily set within your Account settings.

4.2 Automated Collection

• Platform Logs: Technical data automatically collected when you access the aha888 Platform, including IP address, device identifiers, and session activity.
• Cookies and Similar Technologies: Tracking mechanisms described in detail in Section 7 of this Policy.
• Game Activity: Automatically recorded data relating to all games played on the Platform, including stake amounts, outcomes, and session duration.

4.3 Third-Party Sources

• Payment Processors: Transaction confirmation data from GCash, Maya, and banking partners to reconcile deposits and withdrawals.
• KYC Verification Partners: Identity verification results from contracted third-party providers used to confirm the authenticity of government-issued documents.
• Fraud Detection Services: Risk scoring data from contracted security service providers used to detect fraudulent account activity.

aha888 processes personal data on the following legal bases as provided under Section 12 and Section 13 of the Data Privacy Act of 2012:

• Consent: Where you have given clear, freely given, specific, informed consent to the processing of your personal data for a stated purpose — primarily marketing communications and optional account features.
• Contractual Necessity: Processing necessary to fulfill our obligations under the aha888 Terms & Conditions, including Account creation, game services, and payment processing.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and AMLC reporting requirements.
• Legitimate Interests: Processing necessary for aha888's legitimate interests, provided those interests are not overridden by your rights — including fraud prevention, platform security, responsible gaming monitoring, and improvement of our services.
• Vital Interests: In exceptional circumstances where processing is necessary to protect your vital interests or those of another person — for example, in connection with responsible gaming interventions.

aha888 uses the personal data we collect for the following purposes, each of which is grounded in one of the legal bases identified in Section 5:

aha888 does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects without human review, except where required to fulfill legal obligations such as AMLC transaction monitoring.

The aha888 Platform uses cookies and similar tracking technologies to improve the user experience, maintain session security, and gather analytics data about Platform usage. By continuing to use the Platform after being presented with our cookie notice, you consent to our use of cookies as described below.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the operation of the Platform, including session authentication and security tokens. These cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Store your preferences such as language settings, game lobby filters, and responsible gaming tool configurations to provide a personalised experience across sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players navigate and use the Platform, enabling aha888 to identify areas for improvement. Data collected is not linked to individually identifiable players.
• Security Cookies: Used to detect and prevent fraudulent activity, including suspicious login patterns, multiple account creation from the same device, and bot activity.

7.2 Managing Cookies

You may control non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair your ability to access the Platform and your Account. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Safari, Firefox, Samsung Browser, etc.).

aha888 does not sell your personal data to third parties. We share personal data only in the following limited circumstances, each of which is grounded in a legitimate basis:

8.1 Service Providers (Personal Information Processors)

aha888 engages trusted third-party service providers who process personal data on our behalf under binding contractual agreements. These providers are prohibited from using your data for any purpose other than the specific service contracted and must maintain data security standards equivalent to those applied by aha888. Categories of service provider include:

• Payment processors and e-wallet operators (GCash/GXI, Maya/Paymaya Philippines, Inc., BancNet, banks)
• KYC and identity verification technology providers
• Cloud infrastructure and hosting providers
• Fraud detection and cybersecurity service providers
• Customer support platform providers

8.2 Regulatory & Legal Disclosure

aha888 may disclose personal data to regulatory bodies and law enforcement authorities where required or permitted by Philippine law, including:

• PAGCOR — in connection with gaming licence obligations and compliance audits
• Anti-Money Laundering Council (AMLC) — mandatory suspicious transaction reporting under RA 9160
• National Privacy Commission (NPC) — in connection with data breach notifications or NPC investigations
• Philippine courts and law enforcement agencies — in response to lawful court orders, search warrants, or subpoenas

8.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of aha888's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. aha888 will notify affected Players in advance of any such transfer where required by law.

Under the Data Privacy Act of 2012 (RA 10173) of the Philippines, you have the following rights with respect to your personal data held by aha888. To exercise any of these rights, contact our Data Protection Officer using the details in Section 16:

aha888 will respond to all verifiable data rights requests within thirty (30) calendar days of receipt, or within the extended period permitted by law where requests are complex. We may require identity verification before processing a rights request to prevent unauthorised disclosure of another person's data.

aha888 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

aha888 implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction. Key measures include:

• Encryption in Transit: All data transmitted between your browser and aha888 servers is encrypted using TLS (HTTPS). This applies to all Platform pages, cashier transactions, and API communications.
• Encryption at Rest: Sensitive personal data and financial records stored in aha888's databases are encrypted using AES-256 or equivalent industry-standard encryption.
• Access Controls: Access to personal data is restricted to aha888 staff and contractors with a documented operational need. Role-based access controls enforce the principle of least privilege.
• Multi-Factor Authentication: Internal systems containing personal data require multi-factor authentication for staff access. OTP-based two-factor authentication is available to Players for Account security.
• Vulnerability Management: aha888 conducts regular security assessments and penetration testing of the Platform and data infrastructure.
• Incident Response: aha888 maintains a documented data breach response procedure. In the event of a personal data breach affecting your data, aha888 will notify the National Privacy Commission and affected Players within the timeframes required by RA 10173.

The aha888 Platform is strictly intended for adults 21 years of age and older. aha888 does not knowingly collect personal data from individuals under 21 years of age.

Age verification is a mandatory step of the Account registration and KYC process. If aha888 discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, we will:

• Immediately suspend the associated Account
• Delete or permanently anonymise the personal data collected, subject to any mandatory regulatory retention requirements
• Report the matter to PAGCOR and relevant Philippine authorities where required

Parents and guardians who believe their child's personal data may have been collected by aha888 are encouraged to contact us immediately using the contact details in Section 16 so that we may investigate and take appropriate remedial action.

In order to deliver its services, aha888 may transfer personal data to third-party service providers whose systems or infrastructure are located outside the Philippines, including cloud hosting providers and technology partners.

All cross-border transfers of personal data are conducted in accordance with Section 21 of the Data Privacy Act of 2012 and the NPC's guidelines on cross-border data flows. aha888 ensures that adequate data protection safeguards are in place for all international transfers, which may include:

• Contractual clauses in data processing agreements that require recipient processors to maintain equivalent data protection standards
• Transfer to jurisdictions recognised by the NPC as providing adequate data protection
• Binding corporate rules where applicable

Upon request, aha888 can provide further information about specific cross-border transfer mechanisms applicable to your personal data. Contact our Data Protection Officer using the details in Section 16.

aha888 may send promotional communications to Players who have opted in to receive them, including information about bonuses, new games, tournaments, and platform updates. Marketing communications are sent via SMS to your registered Philippine mobile number and/or email.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in your aha888 Account settings
• Replying "STOP" to any SMS message received from aha888
• Contacting aha888 support with an unsubscribe request

Opting out of marketing communications does not affect your receipt of transactional communications, which include deposit and withdrawal confirmations, OTP authentication messages, security alerts, and Account verification notices. These communications are essential to your Account and cannot be disabled while your Account is active.

Players who are currently enrolled in a self-exclusion or cooling-off period will not receive any promotional marketing communications from aha888 for the duration of that restriction period, regardless of their marketing consent status.

aha888 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or guidance issued by the National Privacy Commission. We will notify registered Players of material changes via their registered mobile number or email, and by posting a prominent notice on the aha888 Platform.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We recommend reviewing this Policy periodically to stay informed of how aha888 is protecting your personal data. Continued use of the Platform after notification of an amendment constitutes your acceptance of the revised Policy.

Where an amendment requires fresh consent under RA 10173, aha888 will seek that consent before processing your data under the revised terms.

For any questions, concerns, or requests relating to this Privacy Policy or aha888's data processing practices, please contact our Data Protection Officer:

If you are not satisfied with aha888's response to a data rights request or privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines:

Please include your full name (as registered with aha888), a clear description of your concern, and any relevant Account reference numbers in all privacy-related communications to ensure your inquiry is routed and resolved efficiently.