sagisag Privacy Policy

sagisag is the data controller responsible for the personal information collected through the sagisag platform at sagisag.co. In this capacity, sagisag determines the purposes and means of processing your personal data and is accountable to you — and to the National Privacy Commission of the Philippines (NPC) — for that processing.

When this Privacy Policy refers to "sagisag," "we," "us," or "our," it refers to the sagisag platform and its operators. When it refers to "you," "the player," or "the user," it means any individual who accesses or uses any part of the sagisag platform, whether as a registered account holder or a visitor.

sagisag collects personal data that falls into the following categories. The specific data points collected depend on whether you are a visitor, a registered player, or a player who has completed identity verification.

sagisag collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide during registration (name, email, mobile number, date of birth), during KYC document upload, when contacting support, or when updating your account settings.
• Automated collection: Technical and usage data collected automatically as you interact with the sagisag platform — including IP addresses, device identifiers, and session logs — via server logs and first-party analytics tools.
• Payment processors: Transaction references and payment status updates received from GCash, PayMaya, BDO, BPI, Metrobank, and Visa when you make a deposit or receive a withdrawal.
• KYC verification providers: Verification status and identity confirmation results from third-party identity verification services used to validate government-issued ID documents.
• Cookies and similar technologies: Session and preference data stored in browser cookies and local storage as described in Section 9 of this Policy.

sagisag processes your personal data for specific, lawful purposes. The table below maps data categories to their processing purposes:

Under the Data Privacy Act of 2012, sagisag relies on the following lawful bases for processing personal data:

• Contract performance: Processing necessary to register your account, deliver gaming services, process transactions, and provide customer support. Without this processing, sagisag cannot provide you with its services.
• Legal obligation: Processing required to comply with Philippine legal obligations, including PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) compliance, and reporting obligations to the National Privacy Commission.
• Legitimate interests: Processing for fraud detection, security monitoring, duplicate account prevention, and platform analytics — where these interests are not outweighed by your fundamental privacy rights.
• Consent: Processing for optional purposes, primarily marketing communications, where you have freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the legality of prior processing.

sagisag shares your personal data only in the circumstances described below. We do not sell your data to third parties for their own marketing purposes under any circumstances.

• Payment processors (GCash, PayMaya, BDO, BPI, Metrobank, Visa): Transaction data necessary to process your deposit or withdrawal is shared with your chosen payment provider. These providers operate under their own privacy policies and applicable Philippine financial regulations.
• Live casino game providers (Evolution Gaming, Pragmatic Live, SA Gaming, Asia Gaming): Anonymised session identifiers are passed to third-party live studio providers for game delivery. These providers are contractually prohibited from using session data for any purpose beyond game delivery.
• KYC and identity verification services: Identity documents submitted for KYC are processed by certified third-party verification providers operating under data processing agreements with sagisag.
• Regulatory and law enforcement authorities: sagisag will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities when required by law, court order, or valid regulatory request.
• Fraud prevention networks: Anonymised risk signals may be shared with shared fraud prevention databases to protect the broader Philippine online gaming ecosystem.
• Professional advisers: Legal counsel, auditors, and cybersecurity consultants engaged by sagisag under strict confidentiality obligations.

sagisag stores personal data on secure servers located in the Philippines and in jurisdictions that provide adequate data protection standards as determined under the Data Privacy Act. All storage providers are subject to data processing agreements binding them to sagisag's security standards.

Retention periods are determined by the purpose for which data was collected and by applicable legal obligations:

• Account data: Retained for the duration of your active account relationship with sagisag, plus 5 years following account closure. This retention period satisfies AMLA record-keeping requirements.
• KYC and identity documents: Retained for a minimum of 5 years from the date of submission, consistent with AMLC compliance obligations.
• Transaction and gaming records: Retained for 5 years from the date of each transaction, for regulatory audit and dispute resolution purposes.
• Customer support communications: Retained for 2 years from the close of each support interaction.
• Marketing consent records: Retained until consent is withdrawn and for 1 year thereafter as proof of consent withdrawal.
• Technical and access logs: Retained for 12 months on a rolling basis for security monitoring and fraud detection.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be associated with any individual.

sagisag implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: TLS 1.3 with AES-256 encryption secures all data transmitted between your device and sagisag's servers. Our SSL certificate is validated and renewed automatically.
• Encryption at rest: Sensitive personal data — including identity documents and financial references — is encrypted at rest using AES-256 within our database systems.
• Password security: Account passwords are hashed using bcrypt with a per-user salt before storage. sagisag staff cannot access or recover plain-text passwords.
• Two-factor authentication: Optional 2FA is available to all sagisag players. We strongly recommend enabling it. Certain high-value account actions may require 2FA verification regardless of account settings.
• Access controls: Internal access to personal data is restricted on a need-to-know basis. All staff with data access undergo data privacy training and are bound by confidentiality obligations.
• Penetration testing: sagisag commissions regular third-party security assessments of its platform infrastructure.
• Incident response: sagisag maintains a data breach response plan. In the event of a data breach affecting your personal information, you will be notified within 72 hours of sagisag becoming aware of the breach, in accordance with NPC reporting requirements.

sagisag uses cookies and similar browser storage technologies to operate the platform, remember your preferences, and collect anonymised usage analytics. The following cookie categories are in use:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, CSRF protection tokens, and wallet state cookies. You cannot opt out of these without opting out of using sagisag entirely.
• Functional cookies: Remember your display preferences (language, odds format), last visited game category, and responsible gaming settings. Persistent for up to 90 days.
• Analytics cookies: First-party anonymised analytics to understand how players navigate the platform — which game categories are most visited, where players encounter navigation difficulty, and which features drive retention. Data is aggregated and not linked to individual identities.

sagisag does not use third-party advertising cookies or cross-site tracking technologies. You can manage, restrict, or delete cookies through your browser's privacy settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in to your sagisag account.

As a data subject under Republic Act No. 10173, you have the following rights with respect to your personal data held by sagisag. These rights are actionable by contacting our Data Protection Officer.

sagisag is strictly a platform for adults aged 21 and above, consistent with Philippine casino gambling age requirements. sagisag does not knowingly collect personal data from individuals under 21 years of age.

If you are a parent or guardian and believe that a minor has registered on sagisag using false age information, please contact our support team immediately. We will promptly investigate the reported account and, if verified, suspend it and return any deposited funds to the payment source. Any data collected from the minor will be deleted.

The sagisag platform may contain references or links to third-party services — such as payment provider portals (GCash, PayMaya) or game provider studios — that operate under their own, independent privacy policies. sagisag is not responsible for the privacy practices or content of these third-party services.

We recommend reviewing the privacy policies of any third-party service you interact with in connection with your sagisag account, particularly your GCash or PayMaya app through which deposits and withdrawals are processed.

sagisag may send you promotional communications — including email newsletters, SMS notifications, and in-platform messages — about bonuses, new games, sports events (such as upcoming PBA games, UFC fight nights, or holiday promotions), and platform updates.

These communications are sent only with your consent. When you register a sagisag account, you will be given a clear choice to opt in to marketing communications. If you consent and later wish to stop receiving them:

• Click the "Unsubscribe" link in any sagisag marketing email
• Reply STOP to any sagisag promotional SMS
• Update your communication preferences in Account Settings → Notifications
• Contact sagisag support and request removal from marketing lists

Withdrawal of marketing consent does not affect transactional communications — you will still receive account notifications, deposit confirmations, withdrawal updates, and security alerts regardless of your marketing preference.

Some of sagisag's service providers — particularly live casino game studios (Evolution Gaming, Pragmatic Live, SA Gaming) and certain analytics infrastructure — operate servers outside the Philippines. Where personal data is transferred to a jurisdiction outside the Philippines for processing, sagisag ensures that:

• The recipient jurisdiction provides an adequate level of data protection as evaluated by the National Privacy Commission, or
• Appropriate contractual safeguards (standard data protection clauses) are in place with the recipient to ensure your data is handled to the same standard as required under the Data Privacy Act, or
• The transfer is necessary for the performance of a contract between you and sagisag (e.g., live dealer game delivery).

sagisag may update this Privacy Policy from time to time to reflect changes in our data processing practices, new legal obligations, or feedback from players and the National Privacy Commission. Material updates — those that meaningfully affect how your data is used — will be communicated via email to your registered address or via an in-platform notification upon your next login.

The date of the most recent revision is always displayed at the top of this page. We encourage you to review this Policy periodically. Continued use of the sagisag platform after the effective date of any update constitutes your acknowledgment of the revised Policy.

Non-material changes — such as clarifications of existing practices, corrections of typographical errors, or structural reformatting without substantive content change — will not be separately communicated but will be reflected in the updated date at the top of this page.

For any questions, concerns, or requests relating to this Privacy Policy or sagisag's handling of your personal data, please contact us through the following channels:

• Data Protection Officer — Email: [email protected] (subject: "Data Privacy Request" — plain text, not a link)
• Live Chat: Available 24/7 via the sagisag platform. Average response time: 3–5 minutes. Request connection to the Data Protection Officer for formal privacy matters.

If you are not satisfied with sagisag's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which oversees the enforcement of the Data Privacy Act of 2012. The NPC can be reached through their official government channels.