This Privacy Policy explains how we handle personal data when you visit event.com.ph, open a Casino Plus account and play. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, issuances of the National Privacy Commission (NPC) and the requirements of PAGCOR.
1. Who we are
The personal information controller is Stotsenberg Leisure Park & Hotel Corporation, doing business as Casino Plus, a gaming operator regulated by the Philippine Amusement and Gaming Corporation (PAGCOR). You can reach our privacy team at privacy@event.com.ph.
Company Address: Gil Puyat Avenue, corner Andres Soriano Street, Clark Freeport Zone, Pampanga, Philippines.
2. Data we collect
Registration data
Mobile number, email address, your password or PIN (stored in protected form), OTP verification records, full name, date of birth, nationality, address, occupation and similar details you enter when you register.
KYC documents
Images and data from the valid government-issued ID you submit, such as ID type and number, name, photo, date of birth and expiry date.
Identity and biometric data
During eKYC we capture a selfie or short video for a liveness check and compare it with the photo on your ID. This biometric data is sensitive personal information and is used only to confirm your identity and prevent fraud.
Financial information
Wallet balance, deposits, withdrawals, the payment methods and accounts you use, transaction references and any information needed for anti-money-laundering checks, such as source of funds.
Gameplay data
Games opened, bets, results, session times, favourites, responsible gaming limits and exclusion requests.
Device and technical data
IP address, approximate location derived from it, device type, operating system, browser, session identifiers, sign-in times and security logs. See our Cookie Policy for the cookies we use.
Communications
Messages you send to support, complaints and our replies.
3. Why we use your data
- Account — to create and run your account, sign you in and keep one active session.
- KYC and AML — to verify your identity and meet anti-money-laundering and counter-terrorist-financing obligations.
- Eligibility checks — to confirm you are 21 or older and not a restricted person, including checks against the National Database of Restricted Persons (NDRP) and exclusion lists.
- Payments — to process deposits and withdrawals through our financial partners.
- Security and fraud prevention — to protect accounts, detect multiple accounts, collusion, bots and other prohibited activity.
- Responsible gaming — to apply limits, reminders, cooling-off and exclusions, and to notice signs of harmful play.
- Legal and regulatory reporting — to report to PAGCOR and other authorities when the law requires it.
- Support — to answer questions and handle complaints.
We do not sell your personal data.
4. Legal bases
Under RA 10173 we rely on the following bases:
- Contract (Section 12(b)) — processing needed to provide the account and services you asked for.
- Legal obligation (Section 12(c)) — processing required by law and PAGCOR rules, such as KYC, AML, eligibility and exclusion checks and regulatory reporting.
- Legitimate interests (Section 12(f)) — security, fraud prevention and improving the service, where these do not override your rights.
- Consent (Section 12(a)) — where we ask for it, for example for optional cookies or marketing. You can withdraw consent at any time.
Sensitive personal information, including government-issued ID numbers and biometric data, is processed only on the grounds listed in Section 13 of RA 10173. The table below shows which basis applies to each purpose.
| Purpose | Data used | Legal basis |
|---|---|---|
| Opening and running your account | Mobile number, email, credential, profile details | Contract — Section 12(b) |
| Identity verification (KYC) and anti-money-laundering checks | ID document data and images, address, occupation, source of funds | Legal obligation — Section 12(c); for ID numbers, processing provided for by law — Section 13(b) (Anti-Money Laundering Act, RA 9160 as amended, and PAGCOR rules) |
| Biometric identification and liveness check | Selfie or short video, facial template, ID photo | Processing provided for by law — Section 13(b), together with your specific consent — Section 13(a), given at the eKYC step |
| Age, NDRP, exclusion and restricted-person checks | Name, date of birth, ID data, exclusion status | Legal obligation — Section 12(c) and Section 13(b) |
| Deposits and withdrawals | Payment account details, transaction records | Contract — Section 12(b); legal obligation for record-keeping — Section 12(c) |
| Security, fraud and multiple-account prevention | Device and technical data, sign-in logs, gameplay patterns | Legitimate interests — Section 12(f); legal obligation where AML rules apply |
| Responsible gaming limits and exclusions | Limits, cooling-off, exclusion requests, gameplay data | Legal obligation — Section 12(c) (PAGCOR responsible gaming rules) |
| Complaints and support | Messages, contact details, account records | Contract — Section 12(b); establishing or defending legal claims — Section 13(f) |
| Marketing and optional cookies | Email, mobile number, cookie preferences | Consent — Section 12(a), which you can withdraw at any time |
Biometric data in eKYC
- What we collect. A selfie or a short video taken during the liveness check, and a facial template created from it to compare your face with the photo on your ID.
- Why. Philippine anti-money-laundering rules and PAGCOR require us to confirm that the person opening the account is the real holder of the ID and is not a restricted person. The liveness check also stops accounts being opened with stolen or edited photos.
- Legal basis. Section 13(b) of RA 10173 — processing provided for by existing laws and regulations — together with your specific consent, which you give by ticking the eKYC consent box before the check starts.
- Is it mandatory? Yes. Identity verification is a condition of every online gaming account. If you do not provide the selfie or video, or withdraw your consent before the check is complete, we cannot verify you, and the account cannot be activated.
- Processing by the eKYC provider. The check is run by an eKYC service provider acting as our personal information processor under a written outsourcing agreement. The provider processes the images only on our instructions and only to produce the verification result. It may not use them to train its own systems, sell them or share them. Data is sent and stored in encrypted form.
- Automated decision. The face comparison is automated. If the check fails, a trained staff member reviews the case before any final refusal, and you can ask for that review through the Contact page.
- Deletion. See the retention table in section 6. The selfie, video and facial template are deleted after the check; we keep only the verification result and its reference number.
5. Who we share data with
We share personal data only as needed for the purposes above and under appropriate agreements:
- eKYC providers — to verify your ID and run the liveness check;
- payment partners — banks, e-wallets and other financial partners that process deposits and withdrawals;
- game providers — to run games and record results, using an account identifier rather than your full profile where possible;
- PAGCOR and authorities — including the Anti-Money Laundering Council, courts and law enforcement, when required by law;
- IT and hosting providers — for hosting, security, communications and support tools.
Where data is processed outside the Philippines, we require the same level of protection as under Philippine law.
6. How long we keep data
We keep personal data only for as long as needed for the purposes described here and for as long as required by law and regulation, including PAGCOR and anti-money-laundering record-keeping rules. Under the Anti-Money Laundering Act (RA 9160, as amended) and its rules for casinos, identification and transaction records must be kept for at least five years. The table shows how long each category is kept and what happens at the end of that period.
| Data category | How long we keep it | Why | At the end of the period |
|---|---|---|---|
| Registration and profile data | While the account is open, then 5 years after it is closed | Contract; AML record-keeping | Deleted |
| Unfinished registrations (no eKYC completed) | 90 days after the last step | To let you finish the registration | Deleted |
| KYC documents (ID images and ID data) | While the account is open, then 5 years after it is closed | AML Act and PAGCOR identification rules | Deleted, including copies held by the eKYC provider |
| eKYC selfie and liveness video | Up to 30 days after the verification result | To review a failed or disputed check | Deleted by us and the eKYC provider |
| Facial template (biometric comparison data) | Not stored after the check | Used only to produce the match result | Discarded as soon as the result is produced |
| eKYC result (pass/fail, date, provider reference) | While the account is open, then 5 years after it is closed | Proof that verification was done (AML, PAGCOR) | Deleted |
| Payment history (deposits, withdrawals, payment accounts) | 5 years from the date of each transaction | AML Act; tax and accounting rules | Deleted or anonymised for statistics |
| Bets, game rounds and results | 5 years from the date of the round | PAGCOR audit and AML; complaint handling | Deleted or anonymised for statistics |
| Responsible gaming limits, cooling-off and exclusion records | For the exclusion period, then 5 years after it ends or after the account is closed | PAGCOR rules; preventing an excluded person from re-registering | Deleted |
| Refused applications (failed age, NDRP or restricted-person check) | 5 years after the refusal | AML and PAGCOR; stopping repeated attempts | Deleted |
| Support messages and complaints | 3 years after the case is closed | Handling follow-ups and legal claims | Deleted |
| Security and sign-in logs | 12 months | Security and fraud investigation | Deleted |
| Marketing consent and preferences | Until you withdraw consent, then 2 years as proof of the withdrawal | Showing that we respect your choice | Deleted |
Closed accounts
When an account is closed — by you or by us — it is locked straight away and no longer used for marketing. Profile, KYC, payment and gameplay records are then kept in restricted storage, available only to compliance staff, until the periods in the table end.
How deletion works
- Records are deleted automatically when their period ends. Our compliance team checks the deletion runs every month.
- Backups are overwritten in rotation, so deleted data also disappears from backups within 35 days.
- Where data is kept for statistics, it is first anonymised so that it can no longer identify you.
- A period may be extended only while a complaint, investigation, court case or request from PAGCOR or the Anti-Money Laundering Council is open. The data is deleted once the matter is closed.
- You can ask for earlier deletion of data that is not covered by a legal record-keeping duty by writing to privacy@event.com.ph. We reply within 30 days.
7. How we protect data
We use organisational, physical and technical measures to protect personal data, including encrypted connections, access controls based on role, protected storage of credentials, monitoring of sign-ins and sessions, and staff confidentiality obligations. No system is completely secure, so please keep your credentials private and tell us straight away if you suspect misuse. If a personal data breach occurs, we will handle it as required by the NPC, including notification where required.
8. Your rights
As a data subject under RA 10173, you have the right:
- to be informed about how your personal data is processed;
- to access the personal data we hold about you;
- to object to processing, including processing based on consent or legitimate interests;
- to erasure or blocking of data that is incomplete, outdated, false or unlawfully processed;
- to rectification of inaccurate data;
- to data portability, to obtain your data in an electronic, commonly used format;
- to damages for harm suffered because of inaccurate, incomplete, false or unlawfully obtained data;
- to file a complaint with the National Privacy Commission (privacy.gov.ph (opens in a new tab)).
Some rights are limited where we must keep data by law — for example, we cannot erase records that PAGCOR or anti-money-laundering rules require us to keep. To use your rights, write to privacy@event.com.ph from your registered email. We may need to verify your identity first.
9. Cookies
We use only the cookies needed to run the site unless you agree to more. Details are in our Cookie Policy.
10. Changes to this policy
We may update this policy when our services or legal requirements change. The date at the top shows the latest version. Where a change materially affects you, we will let you know on the website or in My Account.
11. Contact
For privacy questions or requests, contact our privacy team at privacy@event.com.ph. For general account help, use the Contact page.
Written requests can also be sent by post to: Stotsenberg Leisure Park & Hotel Corporation, Attention: Data Protection Officer, Gil Puyat Avenue, corner Andres Soriano Street, Clark Freeport Zone, Pampanga, Philippines.