smtaya Casino – Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how smtaya ("smtaya", "we", "us", "our") collects, uses, stores, and protects the personal information of users ("Player", "User", "you") who access the smtaya online casino and sports betting platform at smtaya.net (the "Platform").

smtaya is an online gaming platform serving Filipino players across the Philippines. We operate within the requirements of applicable Philippine data protection legislation, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal information collected through the smtaya platform — whether you are browsing as a guest, registering a new account, depositing funds, playing games, contacting customer support, or interacting with any feature of the smtaya service. Please read this Policy carefully alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and applicable data protection regulations, smtaya is the Personal Information Controller in respect of all personal data collected through the smtaya platform. This means smtaya determines the purposes for which your personal information is processed and the means by which that processing takes place.

smtaya has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection law. If you have any questions about how smtaya handles your personal data, or if you wish to exercise any of your data subject rights described in this Policy, you may contact our DPO through the details provided in Section 15 of this Policy.

3 Personal Data We Collect

smtaya collects personal data that is necessary to provide our gaming services, comply with legal obligations, and maintain a safe and fair platform for all players. The categories of personal data we collect include:

smtaya does not intentionally collect special categories of sensitive personal data (such as health data, religious beliefs, or political opinions) unless you voluntarily provide such information in the context of a responsible gaming request or self-exclusion application, in which case it is processed strictly for player protection purposes.

4 How We Collect Your Data

smtaya collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or filling in any form on the smtaya platform.
• Automated collection: Technical data collected automatically when you access the smtaya platform, including IP address, device identifiers, browser fingerprint, session logs, and cookies. See Section 10 for full details on our cookie use.
• Third-party sources: Identity verification and fraud prevention data received from our KYC service providers and payment processors when you submit verification documents or initiate a transaction. smtaya only engages regulated, reputable third-party data processors for these purposes.
• Gaming activity: Data generated automatically as a result of your gameplay, including bets placed, game outcomes, wagering history, and session information recorded by smtaya's gaming systems and third-party game providers.

5 How We Use Your Personal Data

smtaya processes your personal data only for specified, legitimate purposes. The primary purposes for which we use your data are as follows:

• Account management: To create, verify, maintain, and secure your smtaya player account.
• Service delivery: To provide access to casino games, sports betting, bingo, sabong, and all other features of the smtaya platform.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, InstaPay, Visa, and Mastercard, and to verify that payment methods are registered in your name.
• KYC and identity verification: To comply with our obligations under anti-money laundering (AML) regulations and to verify that all registered players meet smtaya's eligibility requirements, including the 21+ age requirement.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, and other prohibited activity on the smtaya platform.
• Responsible gaming: To monitor player behaviour for signs of problem gambling, to apply deposit limits, self-exclusion requests, and other responsible gaming tools as requested by players or required by our responsible gaming obligations.
• Legal and regulatory compliance: To comply with applicable Philippine law, regulatory directions, court orders, and reporting obligations to PAGCOR and other relevant authorities.
• Customer support: To respond to your enquiries, resolve complaints, and improve the quality of our support services.
• Platform improvement: To analyse usage patterns, improve game offerings, fix technical issues, and enhance the overall smtaya player experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given consent or where smtaya has a legitimate interest in doing so. You may opt out of marketing communications at any time through your account settings or by contacting support.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, smtaya must have a lawful basis for each processing activity involving your personal data. The legal bases on which smtaya relies are:

• Contractual necessity: Processing necessary to perform our contract with you — i.e., to provide the smtaya gaming services you have registered to use. This covers account management, game provision, payment processing, and customer support.
• Legal obligation: Processing required for smtaya to comply with applicable Philippine law and regulatory requirements, including AML obligations, KYC requirements, age verification, and reporting to gaming regulators.
• Legitimate interests: Processing that is necessary for smtaya's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your privacy rights.
• Consent: Where smtaya relies on your consent as the legal basis for processing — such as for optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Sharing Your Personal Data

smtaya does not share your personal data with third parties except in the following circumstances, and only to the extent necessary for each purpose:

• KYC and identity verification providers: Regulated third-party services used to verify your identity and age as part of our onboarding and ongoing compliance processes.
• Payment processors: Payment service providers (including those facilitating GCash, PayMaya, BPI, BDO, Metrobank, InstaPay, Visa, and Mastercard transactions) to enable deposits and withdrawals.
• Game providers: Third-party game studios and live casino operators who supply the games available on the smtaya platform. These providers may process limited gameplay data as part of game operation.
• Fraud prevention and security services: Specialist providers engaged to detect and prevent fraud, money laundering, and account abuse on the smtaya platform.
• Regulatory authorities: PAGCOR, the National Privacy Commission, Philippine law enforcement agencies, and other competent authorities, where disclosure is required by law, court order, or regulatory direction.
• Professional advisers: Lawyers, auditors, accountants, and other professional advisers engaged by smtaya in the course of running its business, subject to binding confidentiality obligations.

All third parties with whom smtaya shares personal data are required to process that data in accordance with applicable data protection law and smtaya's data processing standards. smtaya does not permit any third party to use your personal data for their own independent purposes.

8 Data Retention

smtaya retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. In practice, this means:

• Account and identity data is retained for the duration of your account and for a minimum of five (5) years after account closure, in accordance with Philippine AML record-keeping obligations.
• Financial transaction records are retained for a minimum of five (5) years from the date of each transaction.
• Gaming history and activity logs are retained for a minimum of three (3) years from the date of each session, for dispute resolution and responsible gaming monitoring purposes.
• Customer support records are retained for three (3) years from the date of each interaction.
• Marketing consent records are retained until you withdraw your consent, plus a reasonable period thereafter to demonstrate compliance.

After applicable retention periods have expired and there is no longer a legitimate reason to retain your data, smtaya will securely delete or anonymise your personal information in accordance with our data disposal procedures.

9 Data Security

smtaya takes the security of your personal data seriously and implements appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption: All data transmitted between your device and smtaya's servers is encrypted using industry-standard TLS (Transport Layer Security) protocols. Sensitive data including passwords is stored using strong one-way hashing algorithms.
• Access controls: Access to personal data is restricted to smtaya staff and contractors who have a genuine operational need to access it. All staff with access to personal data are subject to confidentiality obligations.
• Infrastructure security: smtaya's platform is hosted on secure, monitored infrastructure with regular security patching, vulnerability assessments, and intrusion detection measures in place.
• Two-factor authentication: smtaya offers two-factor authentication (2FA) to all registered players to provide an additional layer of protection for account access.
• Incident response: smtaya maintains a data breach response plan and will notify affected players and the National Privacy Commission in the event of a personal data breach, in accordance with the timeframes required by the Data Privacy Act of 2012.

10 Cookies & Tracking Technologies

smtaya uses cookies and similar tracking technologies on the smtaya platform to enhance your experience, ensure platform functionality, and collect analytics data. The types of cookies smtaya uses are:

• Strictly necessary cookies: Essential for the operation of the smtaya platform, including session management, login authentication, and security features. These cookies cannot be disabled without affecting core platform functionality.
• Functional cookies: Used to remember your preferences and personalise your smtaya experience, such as your preferred language, display settings, and recently played games.
• Analytics cookies: Used to collect aggregated, anonymised data about how players use the smtaya platform, enabling us to identify and resolve technical issues and improve the user experience.
• Marketing cookies: Used to understand the effectiveness of smtaya's promotional campaigns and to show you relevant offers based on your activity on the platform. These cookies are only placed with your consent where required by applicable law.

You can control and manage cookies through your browser settings. Blocking certain categories of cookies may affect the functionality of the smtaya platform. By continuing to use smtaya after being presented with our cookie notice, you consent to our use of cookies as described in this Policy.

11 Your Data Privacy Rights

Under the Data Privacy Act of 2012 and applicable Philippine data protection regulations, you have the following rights in respect of the personal data smtaya holds about you. You may exercise any of these rights by contacting smtaya's Data Protection Officer using the details in Section 15.

smtaya will respond to all valid data subject requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, in which case smtaya will notify you of the extension and the reason for it. smtaya may request proof of your identity before actioning any request to ensure your data is not disclosed to or amended by an unauthorised party.

12 Minors & Age Policy

The smtaya platform is strictly intended for use by persons who are 21 years of age or older, in accordance with the minimum legal age for online casino gambling in the Philippines. smtaya does not knowingly collect personal data from any individual under the age of 21.

During the registration process, smtaya collects date of birth information and may require documentary proof of age as part of KYC verification to confirm that all registered players meet this age requirement. Any account discovered to belong to a player under the age of 21 will be immediately closed, and any personal data collected in connection with that account will be deleted in accordance with applicable law.

If you are a parent or guardian and believe that a minor in your care has registered an account or provided personal data to smtaya, please contact our support team immediately using the details in Section 15 so that we can take prompt action.

13 International Data Transfers

smtaya primarily processes your personal data within the Philippines. However, some of the third-party service providers we engage — including certain game providers, KYC verification services, and cloud infrastructure providers — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, smtaya takes steps to ensure that an appropriate level of protection is maintained for your data in accordance with the requirements of the Data Privacy Act of 2012. This may include entering into data processing agreements with the relevant third parties that incorporate appropriate data transfer safeguards.

smtaya will not transfer your personal data to any jurisdiction that does not provide an adequate level of data protection without first implementing appropriate safeguards and, where required, obtaining your consent to the transfer.

14 Changes to This Privacy Policy

smtaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform features. When we make material changes to this Policy, we will notify registered players via email or through a prominent notice on the smtaya platform prior to the changes taking effect.

The date of the most recent revision of this Policy is displayed at the top of this page. We encourage you to review this Policy periodically to stay informed about how smtaya is protecting your personal information. Your continued use of the smtaya platform after any amendment to this Policy constitutes your acceptance of the updated terms.

15 Contact Us & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or smtaya's handling of your personal data, please contact our Data Protection Officer:

If you are not satisfied with smtaya's response to your privacy concern or believe that smtaya has processed your personal data in breach of the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information about how to submit a complaint to the NPC is available on the NPC's official website.