spinml Privacy Policy
Your Data, Your Rights

spinml ("we," "us," "our") is committed to protecting the privacy and personal data of all users ("Players," "you," "your"). This Privacy Policy describes the personal information we collect, how we use it, with whom we share it, and the rights you have in relation to your data.

By registering an Account with spinml or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

This Privacy Policy is governed by Republic Act No. 10173, the Data Privacy Act of 2012 (the "DPA"), and its implementing rules and regulations, together with all circulars, orders, and issuances of the National Privacy Commission of the Philippines.

For the purposes of the Data Privacy Act of 2012, the data controller responsible for your personal information is spinml, operating at spinml.cam. spinml determines the purposes and means of processing your personal data.

Our registered office and primary data storage facilities are located within the Republic of the Philippines. All data processing activities comply with Philippine data protection law and are subject to the jurisdiction of the National Privacy Commission.

If you have questions about how we process your personal data, or if you wish to exercise any of your data subject rights under the DPA, please contact our Data Protection Officer at the contact details provided in Section 15 of this Policy.

spinml collects the following categories of personal data in connection with the provision of our gaming services:

3.1 Account Registration Data

• Full legal name
• Date of birth
• Email address
• Mobile phone number
• Residential address
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Government-issued identification documents (Philippine National ID, passport, driver's license, UMID, PRC ID, etc.)
• Photographs of identification documents
• Facial biometric data captured during identity verification (selfie verification)
• Proof of address documentation (utility bills, bank statements)
• Source-of-funds documentation (where requested for large transactions)

3.3 Financial and Transaction Data

• Payment instrument details (GCash account name, Maya account name, bank account details, USDT wallet addresses)
• Deposit and withdrawal transaction records
• Betting and gaming transaction history
• Balance and wallet information
• Bonus claims and wagering progress

3.4 Gaming Activity Data

• Game selection and play history
• Wager amounts and game outcomes
• Session duration and frequency
• Responsible gaming limit configurations

3.5 Technical and Device Data

• IP address and geographic location (derived from IP)
• Device type, operating system, and browser information
• Cookie identifiers and session data
• Access logs and timestamp records

3.6 Communications Data

• Customer support enquiry records and correspondence
• Chat logs with live support agents
• Email and SMS communications

spinml processes your personal data for the following purposes:

• Account Creation and Management: To register and maintain your Player Account, authenticate login attempts, and manage Account settings.
• Identity and Age Verification: To verify your identity, confirm that you are 21 years of age or older, and satisfy KYC requirements under PAGCOR regulations and the Anti-Money Laundering Act (AMLA).
• Payment Processing: To process deposits, withdrawals, and other financial transactions, and to reconcile payment records.
• Service Provision: To provide access to games, sports betting markets, promotions, and other platform features.
• Regulatory Compliance: To comply with legal obligations under the Anti-Money Laundering Act, the Data Privacy Act, PAGCOR regulations, and other applicable laws, including submission of reports to regulatory authorities where required.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, money laundering, underage gambling, multi-accounting, bonus abuse, and other violations of our Terms & Conditions.
• Responsible Gaming: To monitor play patterns, enforce player-set limits, and intervene where behaviour suggests problem gambling.
• Customer Support: To respond to enquiries, resolve disputes, and provide technical assistance.
• Marketing and Promotions: To send promotional offers, bonus notifications, and other marketing communications (where you have consented to receive such communications).
• Platform Improvement: To analyse usage patterns, improve platform functionality, and develop new features.

Under the Data Privacy Act of 2012, spinml processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary for the performance of our contract with you (the Terms & Conditions), including Account operation, payment processing, and service provision.
• Legal Obligation: Processing is required to comply with Philippine laws, including AMLA, PAGCOR regulations, tax obligations, and data protection requirements.
• Legitimate Interest: Processing is necessary for our legitimate business interests — fraud prevention, security, dispute resolution, and platform improvement — provided such interests do not override your fundamental rights and freedoms.
• Consent: Where processing is based on consent (e.g., marketing communications, non-essential cookies), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

spinml does not sell, rent, or trade your personal data to third parties for marketing purposes. We share personal data with the following categories of recipients only where necessary for service provision or legal compliance:

6.1 Payment Service Providers

GCash, Maya (PayMaya), BPI, BDO, Metrobank, UnionBank, 7-Eleven Cliqq, Coins.ph, Visa, Mastercard, and other licensed payment processors receive transaction data necessary to process deposits and withdrawals. These providers are bound by their own privacy policies and applicable financial regulations.

6.2 KYC Verification Providers

spinml uses third-party identity verification services to perform document authentication, biometric verification, and fraud screening. These providers process identification documents and biometric data solely for verification purposes and are contractually prohibited from using such data for any other purpose.

6.3 Game Suppliers

Third-party game providers (Pragmatic Play, Evolution Gaming, and others) receive limited Player data — typically a pseudonymised Player ID and wager information — to enable game functionality. Game suppliers do not receive identifying personal information such as name, email, or identification documents.

6.4 Regulatory Authorities

spinml is required to disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other Philippine government agencies where legally mandated.

6.5 Legal and Professional Advisors

We may disclose personal data to external legal counsel, auditors, and compliance consultants under strict confidentiality obligations where necessary for legal advice, audit, or regulatory compliance.

6.6 Law Enforcement and Judicial Authorities

We will disclose personal data to law enforcement agencies or courts in response to valid legal process (subpoenas, court orders, warrants) or where disclosure is necessary to prevent harm, detect crime, or protect legal rights.

spinml stores and processes the majority of personal data within the Philippines. In limited circumstances, personal data may be transferred to third-party service providers located outside the Philippines (for example, cloud infrastructure providers or specialised security services).

Where international transfers occur, spinml ensures that appropriate safeguards are in place in accordance with Section 20 of the Data Privacy Act and NPC Circular No. 16-03, including:

• Transfers to jurisdictions that the National Privacy Commission has determined provide adequate data protection;
• Use of Standard Contractual Clauses or other legally approved transfer mechanisms;
• Contractual obligations requiring the recipient to implement security measures equivalent to those required under Philippine law.

Players may request information about specific international transfers by contacting our Data Protection Officer at the contact details in Section 15.

spinml implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Our security practices include:

• Encryption: All data transmitted between your device and spinml servers is encrypted using 256-bit SSL/TLS protocols. Sensitive data at rest (KYC documents, financial records) is stored in encrypted form.
• Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. All system access is logged and monitored.
• Authentication: Player Accounts are protected by secure password authentication. We recommend enabling two-factor authentication (2FA) where available.
• Infrastructure Security: Servers are hosted in secure, ISO-certified data centres with physical access controls, intrusion detection systems, and 24/7 monitoring.
• Regular Audits: spinml conducts regular security audits, vulnerability assessments, and penetration testing to identify and remediate potential weaknesses.
• Incident Response: We maintain a documented data breach response plan in accordance with NPC requirements. In the event of a personal data breach, we will notify affected data subjects and the National Privacy Commission within the timeframes required by law.

While we implement robust security measures, no system is entirely impervious to attack. Players are responsible for maintaining the confidentiality of their login credentials and must report any suspected unauthorised access immediately.

spinml retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active Account Data: Retained for the duration of Account registration and use.
• Closed Account Data: Retained for five (5) years following Account closure, as required by the Anti-Money Laundering Act and PAGCOR record-keeping requirements.
• KYC and Identity Documents: Retained for five (5) years following the last transaction or Account closure, whichever is later.
• Financial Transaction Records: Retained for ten (10) years in accordance with Bureau of Internal Revenue regulations.
• Gaming and Betting Records: Retained for five (5) years as required by PAGCOR.
• Marketing Consent Records: Retained until consent is withdrawn, plus an additional period necessary to demonstrate compliance with data protection obligations.
• Legal and Dispute Records: Retained for the duration of any legal proceedings or regulatory investigation, plus the applicable statute of limitations period.

At the conclusion of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be associated with an identifiable individual.

spinml uses cookies and similar tracking technologies to enhance platform functionality, analyse usage, and deliver personalised content. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for platform operation, including session management, authentication, and security features. These cookies cannot be disabled.
• Functional Cookies: Enable enhanced functionality such as language preference, timezone settings, and remember-me features.
• Analytics Cookies: Collect aggregated usage data to help us understand how Players interact with the platform and identify areas for improvement.
• Marketing Cookies: Used to deliver targeted promotional content and measure campaign effectiveness (used only with your consent).

You may manage cookie preferences through your browser settings. Note that disabling essential cookies will impair platform functionality and may prevent you from using certain features.

For detailed information about the cookies we use, please refer to our Cookie Policy (available upon request from customer support).

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data:

11.1 Right to Information

You have the right to be informed about the collection and processing of your personal data. This Privacy Policy constitutes our primary disclosure in satisfaction of this right.

11.2 Right of Access

You may request access to the personal data we hold about you. We will provide a copy of your data in a commonly used electronic format within thirty (30) days of a verified request.

11.3 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You may update most Account information directly through your Account Settings, or by contacting customer support.

11.4 Right to Erasure / Right to be Forgotten

You may request deletion of your personal data where:

• The data is no longer necessary for the purposes for which it was collected;
• You withdraw consent (where processing was based on consent) and there is no other legal basis for processing;
• You object to processing based on legitimate interest and we cannot demonstrate overriding legitimate grounds.

Note that this right is subject to legal retention obligations. Where we are required by law to retain data (e.g., AMLA and PAGCOR record-keeping requirements), we cannot comply with an erasure request until the mandatory retention period has elapsed.

11.5 Right to Object

You have the right to object to processing of your personal data where such processing is based on legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for legal claims.

11.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller where technically feasible.

11.7 Right to Withdraw Consent

Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

11.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the National Privacy Commission if you believe your data protection rights have been violated. Contact details are provided in Section 15.

spinml may send you promotional communications — including bonus offers, tournament announcements, and platform updates — via email, SMS, or push notification where you have provided consent to receive such communications.

You may withdraw marketing consent at any time by:

• Clicking the "Unsubscribe" link at the bottom of any promotional email;
• Replying "STOP" to any promotional SMS;
• Adjusting notification preferences in your Account Settings;
• Contacting customer support with a written opt-out request.

Note that withdrawing marketing consent does not affect transactional communications (e.g., deposit confirmations, withdrawal notifications, security alerts, regulatory notices), which we will continue to send as necessary for Account operation and legal compliance.

spinml does not knowingly collect personal data from individuals under the age of 21. Our services are available exclusively to persons aged 21 years and above, as required by PAGCOR regulations.

If we become aware that we have inadvertently collected personal data from a person under 21, we will take immediate steps to delete that data and terminate the associated Account.

If you believe that a person under 21 has registered an Account with spinml, please report it immediately to our customer support team.

spinml reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered Players via email or in-platform notification at least seven (7) days prior to the effective date of the change, except where immediate amendment is required by law or regulatory direction.

The current version of this Privacy Policy is always available at spinml.cam/privacy-policy. The "Last Updated" date at the top of this page reflects the date of the most recent amendment.

Continued use of the spinml platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

If you have questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to submit a complaint regarding our data processing practices, please contact our Data Protection Officer:

Email: [email protected]

For general customer support enquiries, you may also contact:

Email: [email protected]

We will acknowledge your request within 48 hours and provide a substantive response within thirty (30) calendar days.

National Privacy Commission

If you are not satisfied with our response to a privacy complaint, or if you believe we have violated your rights under the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission:

National Privacy Commission
5th Floor, Philippine International Convention Center (PICC),
Vicente Sotto St., Pasay City 1307, Philippines
Email: [email protected]
Website: privacy.gov.ph