xdspin Privacy Policy

xdspin is committed to protecting the privacy and personal data of every player and visitor who engages with our platform. We understand that Filipino players entrust us with sensitive information when they register, deposit funds, and play — and we take that responsibility seriously.

This Privacy Policy describes the types of personal data xdspin collects, the purposes for which that data is processed, the circumstances under which we may share it with third parties, and the rights you hold as a data subject under applicable Philippine law — principally the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

By accessing or using the xdspin platform in any capacity, you acknowledge that you have read and understood this Privacy Policy, and you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this policy, you must discontinue use of the xdspin platform immediately and contact support to request account closure.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement between you and xdspin.

For the purposes of the Data Privacy Act of 2012 and all applicable data protection legislation, xdspin acts as the Personal Information Controller (PIC) in respect of all personal data collected via the xdspin platform at xdspin.app.

As the Personal Information Controller, xdspin determines the purposes and means of processing your personal data and is responsible for ensuring that all processing activities comply with applicable Philippine data protection law. Where xdspin engages third-party service providers to process data on its behalf, those parties act as Personal Information Processors (PIP) and are contractually bound to process data only in accordance with xdspin's documented instructions and applicable law.

If you have questions about how xdspin handles your personal data, or if you wish to exercise any of your data subject rights, please contact us using the details provided in Section 13 of this policy.

xdspin collects only the personal data that is necessary and proportionate to the purposes set out in this policy. The categories of personal data we collect include:

xdspin does not intentionally collect sensitive personal information as defined under the Data Privacy Act of 2012 (such as racial or ethnic origin, religious beliefs, health data, or political opinions) unless directly and voluntarily provided by you in a support context. Where such data is inadvertently received, it will be deleted promptly.

xdspin collects personal data through the following channels and methods:

• Direct interactions: Data you provide when you complete the xdspin registration form, verify your identity, make a deposit or withdrawal request, contact our support team, or respond to a survey or promotion.
• Automated technologies: As you browse the xdspin platform, we automatically collect technical and usage data via cookies, server logs, pixel tags, and similar tracking technologies. See Section 9 for full details on cookie usage.
• Identity verification providers: When you submit government-issued identification documents for KYC (Know Your Customer) verification, our regulated verification partner processes those documents on our behalf and returns a verification result to xdspin.
• Payment processors: When you make a deposit or withdrawal via GCash, Maya, BPI, BDO, or other supported Philippine payment channels, the relevant payment processor shares transactional data with xdspin to facilitate and confirm the transaction.
• Anti-fraud and compliance services: xdspin may receive data about your account from third-party fraud prevention and responsible gaming compliance services where required to meet our regulatory obligations.

xdspin processes your personal data only for defined, specified, and legitimate purposes. The primary legal bases under which we process personal data are: (a) performance of a contract — i.e., to provide you with the xdspin gaming services you have registered for; (b) compliance with a legal obligation — e.g., KYC and AML regulatory requirements; (c) legitimate interests — e.g., fraud prevention and platform security; and (d) consent — e.g., for optional marketing communications.

Where xdspin relies on your consent as the legal basis for processing — particularly for marketing communications — you have the right to withdraw that consent at any time by adjusting your account notification preferences or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

xdspin does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Identity verification providers: To conduct KYC and age verification checks on new and existing accounts, as required by applicable Philippine gaming regulations.
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, 7-Eleven, and USDT payment infrastructure providers, solely to facilitate financial transactions requested by you.
• Anti-fraud and AML service providers: Third-party compliance technology providers who assist xdspin in meeting its obligations under Philippine anti-money laundering legislation and PAGCOR regulatory requirements.
• Responsible gaming compliance services: Self-exclusion register operators and problem gambling intervention services, where required to enforce self-exclusion requests or respond to responsible gaming flags on your account.
• IT infrastructure and cloud hosting providers: Secure data hosting and processing providers who store xdspin's platform data under documented data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities, where xdspin is required by law or regulation to disclose information.
• Legal and professional advisers: Law firms, accountants, and other professional advisers bound by confidentiality obligations, where required for the purposes of legal advice or proceedings.

xdspin retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account, plus a minimum of five (5) years following account closure, in compliance with Philippine AML and gaming regulatory record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act of 2001 (as amended) and PAGCOR regulations.
• Gaming and wagering data: Retained for a minimum of three (3) years from the date of each gaming session for audit and dispute resolution purposes.
• Support communications: Retained for a minimum of two (2) years from the date of the last communication, to support ongoing dispute resolution and quality assurance.
• Marketing data: Retained until you withdraw your marketing consent, at which point it is deleted or anonymised within thirty (30) days.
• Technical and log data: Retained for a maximum of twelve (12) months unless required for longer for fraud investigation or regulatory purposes.

When personal data is no longer required for any legitimate purpose, xdspin will securely delete or anonymise it in accordance with our documented data disposal procedures. Anonymised data that cannot be re-linked to an individual may be retained indefinitely for aggregate analytics purposes.

xdspin implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your browser or device and the xdspin platform is encrypted using industry-standard Transport Layer Security (TLS) protocols. Look for the padlock icon in your browser address bar when accessing xdspin.app.
• Password hashing: Account passwords are never stored in plain text. xdspin applies modern, salted cryptographic hashing algorithms to all stored passwords.
• Access controls: Access to personal data within xdspin's systems is restricted on a strict need-to-know basis. Staff access is governed by role-based access controls, and all access to sensitive data is logged and auditable.
• Two-factor authentication (2FA): xdspin provides optional 2FA via SMS OTP for all registered player accounts and mandates 2FA for all internal staff accounts with access to player data.
• Regular security assessments: xdspin conducts periodic vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate potential security weaknesses.
• Data breach response: xdspin maintains a documented incident response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, xdspin will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach and will notify affected players without undue delay as required by law.

xdspin uses cookies and similar tracking technologies to operate and improve the platform, personalise your experience, and fulfil our legal and regulatory obligations. A cookie is a small text file placed on your device when you visit a website. Cookies do not contain executable code and cannot be used to access other data on your device.

The categories of cookies used on the xdspin platform are:

You can manage your cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Note that disabling strictly necessary cookies will prevent you from logging into and using the xdspin platform. For further guidance on managing cookies, refer to your browser's help documentation.

As a data subject under the Philippine Data Privacy Act of 2012, you hold the following rights with respect to your personal data held by xdspin. To exercise any of these rights, please contact us using the details in Section 13. xdspin will respond to all verified data subject requests within thirty (30) calendar days of receipt.

Please note that certain rights are subject to limitations where xdspin is required to retain or process your data to comply with legal obligations — for example, AML record-keeping requirements or ongoing fraud investigations. xdspin will clearly explain any such limitations when responding to your request.

During the registration process, xdspin collects your date of birth and requires submission of a valid government-issued ID for KYC verification. This age verification step is mandatory and non-negotiable — no real-money account will be activated until age verification is satisfactorily completed. Accepted Philippine government IDs include the PhilSys National ID, passport, SSS/GSIS card, driver's license, PRC ID, and Voter's ID.

If you are a parent or guardian and believe your child has registered on the xdspin platform, please contact our support team immediately at [email protected]. We will investigate and take appropriate action as a matter of priority.

xdspin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our processing activities, applicable law, or regulatory requirements. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page.
• Display a prominent notice on the xdspin platform homepage for a minimum of fourteen (14) days following the update.
• Where the changes materially affect your rights or the way we process your data, we will notify registered players directly via their registered email address with at least fourteen (14) days' advance notice before the changes take effect.

Your continued use of the xdspin platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated policy, you must discontinue use of the platform and request account closure before the effective date of the changes.

We encourage you to review this Privacy Policy periodically to stay informed about how xdspin protects your data. Previous versions of this policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way xdspin processes your personal data, please contact our Data Privacy team through the following channel:

If you are not satisfied with xdspin's response to your data privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, the independent government body responsible for administering and enforcing the Data Privacy Act of 2012. You may also seek legal remedies through the appropriate Philippine courts.

For responsible gaming concerns, including self-exclusion requests or problem gambling support, please visit our Responsible Gaming page or contact PAGCOR's responsible gaming resources directly.