nulstar Privacy Policy

1 Introduction

nulstar is a PAGCOR-regulated online casino and sports betting platform operating in the Philippines. We are committed to protecting the privacy and personal data of every player who uses the nulstar platform. This Privacy Policy has been prepared in accordance with Republic Act No. 10173, known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy describes: what categories of personal data nulstar collects from you; the purposes for which that data is collected and processed; the legal bases that authorize nulstar to process your data; how long nulstar retains your data; with whom nulstar shares your data; and the rights you have as a data subject under Philippine law.

This Privacy Policy should be read alongside the nulstar Terms & Conditions and Responsible Gaming Policy, which together form the complete agreement governing your use of the nulstar platform.

2 Data Controller

For the purposes of the Philippine Data Privacy Act, nulstar acts as the Personal Information Controller (PIC) in respect of the personal data it collects from players using the nulstar platform. This means that nulstar determines the purposes and means of processing your personal data.

nulstar has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with the DPA, this Privacy Policy, and all related data protection obligations. You may contact the DPO directly using the contact details set out in Section 14 of this Privacy Policy.

3 Data We Collect

nulstar collects the following categories of personal data from players and prospective players:

3.1 Identity Data

Full legal name, date of birth, gender, nationality, and government-issued identification numbers (such as PhilSys National ID, passport number, driver's license number, SSS number, or GSIS number). This data is collected to verify your identity and confirm that you meet the 21+ age requirement mandated by PAGCOR.

3.2 Contact Data

Email address, Philippine mobile number, and residential address (including barangay, city or municipality, province, and postal code). We use this data to communicate with you about your Account, transactions, promotions, and service updates.

3.3 Financial Data

Bank account details, GCash or PayMaya mobile wallet numbers, BDO, BPI, or Metrobank account references, and transaction histories including deposit amounts, withdrawal requests, and wagering records. This data is required for payment processing and compliance with Anti-Money Laundering Act (AMLA) obligations.

3.4 Gaming Activity Data

Bet history, game preferences, session durations, win and loss records, bonus usage, and responsible gaming tool activations. This data helps nulstar deliver a personalized gaming experience and fulfil its responsible gaming obligations under PAGCOR regulations.

3.5 Technical Data

IP address, device type, operating system, browser type and version, time zone setting, browser plug-in types and versions, and other technical identifiers collected automatically when you access the nulstar platform.

3.6 Usage Data

Information about how you navigate and interact with the nulstar platform, including pages visited, links clicked, search queries entered, and referral sources.

3.7 Communications Data

Records of correspondence between you and nulstar customer support, including chat transcripts, emails, and call recordings where applicable, retained for quality assurance and dispute resolution purposes.

4 How We Collect Your Data

nulstar collects personal data through the following means:

• Direct interactions: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion;
• Automated technologies: Cookies, web beacons, pixel tags, and similar tracking technologies that collect Technical Data and Usage Data as you interact with the nulstar platform (see Section 7 for details);
• Third-party sources: Identity verification service providers, payment processors such as GCash, PayMaya, BPI, BDO, and Metrobank, fraud prevention services, and PAGCOR's centralized player database where applicable;
• Publicly available sources: Information from public records or publicly accessible databases used to supplement identity and address verification.

5 How We Use Your Data

nulstar processes your personal data for the following specific purposes, each supported by a lawful basis under the Data Privacy Act:

6 Sharing Your Data

nulstar does not sell your personal data. We share your data only in the following circumstances:

6.1 Service Providers

nulstar engages trusted third-party service providers to assist in operating the platform and delivering services to players. These include payment processors (GCash, PayMaya, BPI, BDO, Metrobank, and 7-Eleven payment network), identity verification services, cloud hosting providers, customer support software providers, and analytics platforms. All service providers are contractually bound to process your data only as instructed by nulstar and in accordance with the DPA.

6.2 Regulatory and Legal Authorities

nulstar is required to share certain player data with PAGCOR as part of its licensing obligations. nulstar may also be required to disclose personal data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), or other competent Philippine government authorities when required by law, regulation, or a valid legal order.

6.3 Business Transfers

In the event that nulstar undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the relevant successor entity as part of that transaction. nulstar will provide notice to affected players prior to any such transfer and ensure that the successor entity is bound by data protection obligations no less protective than those in this Privacy Policy.

6.4 With Your Consent

nulstar may share your data with additional third parties where you have provided explicit consent for such sharing. You may withdraw this consent at any time by contacting our Data Protection Officer.

7 Cookies and Tracking Technologies

nulstar uses cookies and similar tracking technologies on the nulstar platform to enhance your experience, analyze usage patterns, and support security functions. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function correctly, including maintaining your login session, remembering your Account preferences, and enabling secure transactions. These cookies cannot be disabled.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players use the nulstar platform, such as which pages are most visited and how long sessions last. This data helps nulstar improve the platform experience.
• Functionality Cookies: Allow the platform to remember choices you have made (such as preferred language or responsible gaming settings) to provide a more personalized experience.
• Security Cookies: Help nulstar detect and prevent fraudulent activity, protect your Account from unauthorized access, and ensure the integrity of the gaming environment.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the nulstar platform. Analytics and functionality cookies may be disabled without affecting your ability to access core gaming services.

8 Data Security

nulstar implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• TLS encryption for all data transmitted between your device and the nulstar platform;
• Encryption at rest for sensitive personal data stored on nulstar servers;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular security assessments and penetration testing of the nulstar platform infrastructure;
• Multi-factor authentication options for player Accounts;
• Continuous monitoring for suspicious access patterns and potential security incidents.

9 Data Retention

nulstar retains your personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to the following minimum retention periods required by applicable Philippine law:

• Account and KYC records: Retained for a minimum of five (5) years from the date of Account closure, as required by PAGCOR licensing conditions;
• Financial transaction records: Retained for a minimum of five (5) years in compliance with AMLA record-keeping requirements;
• Communications and support records: Retained for up to three (3) years from the date of the last interaction for dispute resolution and quality assurance purposes;
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of consent;
• Technical and usage logs: Retained for up to twelve (12) months for security and analytics purposes.

Upon expiry of the applicable retention period, nulstar will securely delete or anonymize your personal data in accordance with its data disposal procedures.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 and its IRR, you have the following rights in respect of your personal data held by nulstar:

• Right to be Informed: The right to know whether nulstar holds personal data about you, and to receive this Privacy Policy describing how your data is processed;
• Right to Access: The right to obtain a copy of your personal data held by nulstar and information about how it is being processed;
• Right to Correction: The right to have inaccurate or incomplete personal data corrected or updated. You can update most Account details directly through your nulstar Account settings;
• Right to Erasure or Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to nulstar's legal retention obligations;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe nulstar has not complied with its obligations under the Data Privacy Act.

To exercise any of these rights, please contact nulstar's Data Protection Officer using the contact details provided in Section 14. nulstar will respond to verified requests within fifteen (15) business days. Some requests may require identity verification before they can be processed.

11 Minors and Age Restrictions

nulstar's platform is strictly intended for individuals who are 21 years of age or older, in accordance with PAGCOR regulations and Philippine law. nulstar does not knowingly collect personal data from individuals under the age of 21.

If nulstar discovers or reasonably suspects that an Account belongs to a person under 21 years of age, the Account will be immediately suspended, any funds held therein will be handled in accordance with nulstar's Age Verification Policy, and all personal data associated with the underage Account will be deleted unless retention is required by law.

12 Cross-Border Data Transfers

nulstar's primary data processing infrastructure is located within the Philippines. In certain circumstances, personal data may be transferred to or accessed from servers or service providers located outside the Philippines — for example, in connection with cloud hosting, fraud prevention, or global payment processing networks.

Where such transfers occur, nulstar ensures that adequate safeguards are in place to protect your personal data, including contractual data processing agreements that impose data protection obligations equivalent to those under the Philippine DPA. nulstar will not transfer your personal data to countries or territories that do not provide an adequate level of protection for personal data without first implementing appropriate safeguards and, where required, obtaining your consent.

13 Updates to This Privacy Policy

nulstar may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When material changes are made, nulstar will notify registered players by posting a notice on the platform and, where appropriate, sending an email to the registered Account address at least seven (7) days before the changes take effect.

The effective date at the top of this page indicates when the current version was last updated. Your continued use of the nulstar platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. We encourage you to review this page periodically to stay informed about how nulstar protects your personal data.

14 Contact the Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by nulstar, please contact our Data Protection Officer. Our DPO is available to assist you with all data privacy matters, including the exercise of your rights under the Philippine Data Privacy Act.

You also have the right to contact the National Privacy Commission (NPC) of the Philippines directly if you believe your data privacy rights have been violated and nulstar has not adequately addressed your concern. The NPC is the independent regulatory body responsible for administering and enforcing the Data Privacy Act in the Philippines.