Privacy Policy — s5.com

1.1 This Privacy Policy applies to all personal data collected and processed by s5.com in connection with the registration, operation, and use of the s5.com platform, website, and any related services, features, or communications made available to registered players and website visitors.

1.2 This Policy applies to all individuals who interact with s5.com, including registered players, individuals browsing the website without an account, and individuals who contact s5.com support or participate in promotional activities.

1.3 By registering an account on s5.com or by continuing to use the platform after this Policy has been made available to you, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), s5.com is the personal information controller responsible for your personal data. s5.com operates as a PAGCOR-licensed online gaming platform serving Filipino players across the Philippines.

2.2 s5.com has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and applicable data protection legislation. The DPO can be contacted via the support channels listed in Section 14 of this Policy.

2.3 Decisions regarding the purposes and methods of processing your personal data are made by s5.com in accordance with its legal obligations, regulatory requirements, and the terms of its PAGCOR license.

3.1 s5.com collects personal data across several categories, depending on your level of interaction with the platform. The following table summarises the types of data collected and their primary source:

3.2 s5.com does not collect sensitive personal information such as health records, religious beliefs, or biometric data unless specifically required by PAGCOR regulations, in which case you will be separately notified and your explicit consent obtained.

3.3 s5.com does not collect or store full payment card numbers. GCash transactions are processed through GCash's own secure API. s5.com only retains the transaction reference and the registered GCash mobile number.

4.1 s5.com uses personal data for the following purposes:

• Account Management: To create, maintain, and administer your s5.com player account, including processing your registration, verifying your identity, and enabling access to platform features;
• Payment Processing: To process deposits and withdrawals through GCash, Maya, GrabPay, InstaPay, and Philippine bank transfers, including verifying payment ownership and complying with financial transaction reporting requirements;
• Regulatory Compliance: To fulfil obligations under PAGCOR's online gaming license conditions, including Know-Your-Customer (KYC) verification, Anti-Money Laundering (AML) monitoring and reporting, and age verification;
• Customer Support: To respond to enquiries, complaints, and dispute submissions, and to improve the quality of support services;
• Responsible Gaming: To monitor gaming patterns, enforce deposit limits, process cooling-off and self-exclusion requests, and identify players who may require support under the s5.com Responsible Gaming policy;
• Security: To detect, investigate, and prevent fraud, account takeovers, collusion, money laundering, and other prohibited activity;
• Platform Improvement: To analyse aggregated, anonymised usage data for the purpose of improving the s5.com platform, game offerings, and user experience;
• Legal Obligations: To comply with applicable Philippine laws, respond to regulatory enquiries, and cooperate with law enforcement authorities where required by law.

5.1 s5.com processes personal data on the basis of one or more of the following lawful grounds as established under the Philippine Data Privacy Act of 2012:

• Consent: Processing necessary for purposes for which you have given your express consent at registration or subsequently, including receipt of marketing communications and certain optional platform features;
• Contractual Necessity: Processing necessary for the performance of the contract between you and s5.com, including account management, payment processing, and delivery of gaming services;
• Legal Obligation: Processing necessary for compliance with a legal obligation applicable to s5.com under Philippine law, including PAGCOR regulations, AML obligations, and NPC requirements;
• Legitimate Interests: Processing necessary for the purposes of the legitimate interests pursued by s5.com, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights and freedoms.

5.2 Where s5.com relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6.1 s5.com does not sell, rent, or trade personal data to unaffiliated third parties for commercial or marketing purposes.

6.2 s5.com may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Service Providers: GCash (GXchange, Inc.), Maya (Voyager Innovations), GrabPay, and accredited Philippine banks, for the purpose of processing deposits and withdrawals;
• Game Providers: JILI Games, PG Soft, Pragmatic Play, Fachai, and other integrated game providers, to the extent necessary to authenticate player sessions and resolve game disputes;
• Identity Verification Providers: Third-party KYC service providers engaged to assist in the verification of player identity documents, operating under strict data processing agreements;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by law or regulation;
• Law Enforcement: Philippine law enforcement agencies, where s5.com is required to disclose personal data pursuant to a lawful order, warrant, or legal process;
• Professional Advisers: Legal, audit, and compliance advisers engaged by s5.com, subject to professional confidentiality obligations.

7.1 s5.com retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law and PAGCOR regulations.

7.2 The following retention periods generally apply:

• Account and Identity Data: Retained for the duration of the active account relationship and for a minimum of five (5) years following permanent account closure, as required by PAGCOR and Philippine AML regulations;
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, in accordance with Philippine financial record-keeping requirements;
• Gaming Activity Logs: Retained for a minimum of three (3) years, or longer where required for pending disputes or regulatory investigations;
• KYC Verification Documents: Retained for the duration of the account relationship and for five (5) years after account closure;
• Support Communications: Retained for three (3) years from the date of the interaction, unless a longer period is required for an unresolved complaint or legal proceeding.

7.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with s5.com's data disposal procedures.

8.1 s5.com uses cookies and similar tracking technologies to enable platform functionality, maintain your login session, and collect aggregated usage analytics. The following categories of cookies are used:

• Essential Cookies: Required for the platform to function correctly. These include session authentication cookies and security tokens. They cannot be disabled without preventing platform access.
• Functional Cookies: Used to remember your preferences, such as interface language and display settings. These are not strictly necessary but improve your experience.
• Analytics Cookies: Used to collect anonymised data about how players navigate and use s5.com, for the purpose of improving platform performance. No personally identifiable information is transmitted to analytics providers.

8.2 s5.com does not use third-party advertising cookies or behavioural tracking cookies that share your data with external advertising networks.

8.3 You may manage or disable non-essential cookies through your browser settings. Disabling essential cookies will prevent access to your s5.com account. For most Filipino players accessing s5.com on mobile Chrome, cookie preferences can be managed via Settings → Privacy and Security → Cookies.

9.1 s5.com implements appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between the player's device and s5.com's servers;
• Encryption of stored personal data and financial records at rest;
• Multi-factor authentication for player account access, including SMS-based OTP verification for new device logins;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Regular security assessments and penetration testing of platform infrastructure;
• Automatic session expiry for inactive login sessions;
• Login attempt limits and temporary lockout mechanisms to prevent brute-force attacks.

9.2 In the event of a personal data breach that is likely to prejudice the rights and freedoms of data subjects, s5.com will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with the Data Privacy Act of 2012 and NPC Circular No. 16-03.

10.1 As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by s5.com:

• Right to be Informed: The right to be informed whether personal data pertaining to you is being processed and the manner in which it is being used;
• Right of Access: The right to request access to the personal data s5.com holds about you, and to receive a copy of that data in a commonly used format;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data relating to you;
• Right to Erasure: The right to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to s5.com's legal retention obligations;
• Right to Data Portability: The right to receive personal data provided to s5.com in a structured, commonly used, and machine-readable format;
• Right to Object: The right to object to certain processing of your personal data, including processing for direct marketing purposes;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe s5.com has violated your data privacy rights.

10.2 To exercise any of the above rights, please submit a formal written request to s5.com's Data Protection Officer via the contact details in Section 14. s5.com will respond within fifteen (15) business days of receiving a verifiable request. We may require identity verification before processing rights requests to protect against unauthorised data access.

11.1 s5.com does not knowingly collect personal data from individuals below the age of twenty-one (21) years. Access to s5.com is strictly restricted to adults aged 21 and above, as mandated by PAGCOR and Philippine law.

11.2 If s5.com becomes aware that personal data has been collected from an individual below the minimum age, the account will be immediately suspended, the personal data deleted (subject to any mandatory retention obligations under Philippine law), and any deposited funds returned to the originating payment method.

12.1 s5.com's primary data processing infrastructure is located within or serves the Philippines. However, certain third-party service providers engaged by s5.com — including game providers and KYC service partners — may process data on servers located outside the Philippines.

12.2 Where personal data is transferred to recipients located in countries outside the Philippines, s5.com ensures that appropriate safeguards are in place to protect the transferred data, including contractual clauses that require the recipient to process data to the standard required by the Philippine Data Privacy Act.

12.3 s5.com does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate contractual or technical safeguards.

13.1 s5.com reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. Any material changes to this Policy will be communicated to registered players via SMS or email notification to the contact details on file, and the updated Policy will be published on the s5.com website with a revised effective date.

13.2 We encourage you to review this Privacy Policy periodically to stay informed about how s5.com protects your personal data. Continued use of s5.com following the effective date of any amendment constitutes acceptance of the revised Policy.

13.3 The current version of this Privacy Policy will always be accessible at s5.com/privacy-policy. Prior versions are available upon request to the Data Protection Officer.

14.1 For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by s5.com, please contact our Data Protection Officer using the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the s5.com platform — the fastest way to reach us for account-related privacy enquiries;
• Email: [email protected] — for formal data subject rights requests or DPO enquiries, please mark your message "Privacy / Data Request" in the subject line;
• Postal: Serving players across Manila, Cebu, Davao, Quezon City, Makati, and all regions of the Philippines.

14.2 s5.com aims to respond to all formal privacy requests within fifteen (15) business days. For complex requests, we may extend this period by a further fifteen (15) business days, and we will notify you of the extension and the reasons for it.

14.3 If you are not satisfied with s5.com's response to a privacy complaint, or if you believe s5.com has violated your rights under the Philippine Data Privacy Act, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines.