nurtar Privacy Policy

nurtar ("nurtar," "we," "us," or "our") is the data controller responsible for your personal data processed through the nurtar online gaming platform at nurtar.app. nurtar is a PAGCOR-regulated online gaming operator serving Filipino players across the Philippines.

As data controller, nurtar determines the purposes and means by which your personal data is processed. nurtar has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Philippine Data Privacy Act. Contact details for the DPO are provided in Section 14 of this policy.

For the avoidance of doubt, nurtar's game content providers, payment processors, and other third-party service partners who process personal data in connection with the nurtar platform do so as data processors acting under written data processing agreements with nurtar, bound by confidentiality and security obligations consistent with the requirements of the Data Privacy Act.

nurtar collects personal data about you in the following categories:

2.1 Data You Provide Directly

• Registration data: Full legal name, date of birth, email address, Philippine mobile number, username, and password (stored in hashed form — never in plaintext).
• KYC identity documents: Government-issued photo identification (e.g., Philippine passport, UMID, PhilSys National ID, driver's license, PRC ID), selfie photographs, and proof of payment method ownership, collected in compliance with PAGCOR's mandatory Know Your Customer requirements.
• Financial data: Payment method type (e.g., GCash, Maya, BPI, BDO, UnionBank), the account or reference number associated with deposits and withdrawals, and transaction amounts. Full payment credentials (GCash PINs, bank account passwords) are never collected or stored by nurtar.
• Source of funds documentation: Where required by PAGCOR's anti-money laundering obligations for high-value transactions.
• Support communications: Any information you provide when contacting nurtar Support, including the content of chat, email, or ticket exchanges.
• Responsible gaming declarations: Self-exclusion requests, deposit or loss limit settings, and any disclosures you make in connection with responsible gaming tools.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Session and usage data: Login timestamps, pages visited within the nurtar platform, game sessions initiated and completed, bet amounts, game outcomes, session duration, and interaction patterns.
• Location data: General geographic location derived from IP address (country and city level). nurtar does not collect precise GPS location data.
• Cookies and tracking technologies: As described in Section 6 of this policy.

2.3 Data Received from Third Parties

• Payment processors: Transaction confirmation data including transaction reference numbers, payment status, and timestamps, received from GCash, Maya, and banking partners.
• Identity verification services: Verification outcomes from KYC service providers engaged by nurtar to authenticate identity documents.
• Fraud prevention services: Risk scores and flags from fraud detection partners used to protect both the platform and its players.

nurtar uses your personal data for the following purposes:

nurtar will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by applicable Philippine law.

Under the Philippine Data Privacy Act, nurtar relies on the following legal bases for processing your personal data:

• Contractual necessity: Processing required to fulfill nurtar's obligations under the Terms and Conditions you accepted when creating your account — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (Republic Act No. 9160 as amended), the Tax Code of the Philippines, and other applicable Philippine laws. nurtar cannot waive these obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymized analytics, where such processing is proportionate and does not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications, optional profiling for personalized game recommendations, and any other processing not covered by the bases above. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

nurtar does not sell, rent, or trade your personal data to any third party. nurtar shares your personal data only in the following circumstances:

5.1 Service Providers (Data Processors)

nurtar engages trusted third-party service providers who process personal data on nurtar's behalf under written data processing agreements. These include:

• Payment processors: GCash (GXI), Maya, and banking partners for deposit and withdrawal processing;
• KYC verification providers: Identity verification platforms used to authenticate documents submitted during account verification;
• Cloud infrastructure providers: Hosting and data storage services operating under strict security and confidentiality obligations;
• Game content providers: Certified game studios whose software is integrated into the nurtar platform — these providers receive only the session and game data necessary to operate the specific game;
• Fraud and risk management services: Providers of real-time fraud detection and anti-money laundering screening tools;
• Customer support platform providers: Software tools used by nurtar's support team to manage player inquiries.

All service providers engaged by nurtar are contractually prohibited from using your personal data for any purpose other than providing services to nurtar.

5.2 Regulatory Authorities

nurtar is legally required to share certain player data with Philippine regulatory and law enforcement authorities, including:

• PAGCOR: Ongoing regulatory reporting, licensing audits, and player dispute investigations;
• Anti-Money Laundering Council (AMLC): Mandatory suspicious transaction reports and covered transaction reports as required by the Anti-Money Laundering Act;
• Bureau of Internal Revenue (BIR): Tax-related reporting obligations as required by the National Internal Revenue Code;
• National Privacy Commission (NPC): Personal data breach notifications and regulatory inquiries under the Data Privacy Act;
• Law enforcement agencies: Where nurtar is required to disclose data by valid legal process, court order, or lawful government directive.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of nurtar's business assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to the same privacy protections described in this policy. You will be notified of any such transfer by email before it takes effect.

nurtar uses cookies and similar tracking technologies on the nurtar.app platform. A cookie is a small text file stored on your device by your browser. nurtar uses the following categories of cookies:

• Essential cookies: Required for the platform to function. These cookies maintain your login session, store your language preference, and enable security features such as CSRF protection. You cannot opt out of essential cookies without ceasing to use the platform.
• Functional cookies: Remember your preferences such as game display settings and notification preferences, improving your experience without tracking you across other sites.
• Analytics cookies: Used by nurtar's internal analytics team to understand how players use the platform — which pages are visited, how long sessions last, and where players encounter errors. This data is aggregated and anonymized where possible. You may opt out of analytics cookies via the Cookie Settings accessible in the nurtar platform footer.
• Security cookies: Short-lived cookies used to detect and prevent fraudulent login attempts, credential stuffing, and automated account takeover attacks.

nurtar does not use third-party advertising cookies or allow advertising networks to place tracking technologies on the nurtar.app domain. You will not be retargeted on other websites based on your nurtar platform activity.

nurtar implements a layered security architecture designed to protect your personal data from unauthorized access, disclosure, alteration, and destruction. The technical and organizational security measures applied by nurtar include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 encryption for all data in transit between your device and nurtar's servers;
• Access controls: Role-based access control (RBAC) ensuring that nurtar staff can only access the personal data necessary for their specific role. Access to sensitive data such as KYC documents is restricted to a small number of authorized personnel;
• Penetration testing: Regular third-party penetration testing of the nurtar platform's infrastructure and application layer;
• Two-factor authentication: Available for all player accounts and mandatory for all nurtar staff accessing systems that contain personal data;
• Intrusion detection: Real-time intrusion detection and anomaly monitoring on nurtar's server infrastructure;
• Data minimization: nurtar collects and retains only the personal data necessary for the specified purposes — no collection of data "just in case."

While nurtar takes all reasonable technical and organizational precautions to protect your personal data, no system is entirely impenetrable. In the event of a data breach, nurtar will follow the incident response procedures described in this policy and will notify you as required by Philippine law.

nurtar retains your personal data for the following periods:

• Active account data: Retained for the duration of your account's active status plus the retention periods below following closure.
• KYC documents and identity records: Retained for a minimum of five (5) years from the date of account closure, as required by PAGCOR's AML compliance framework and applicable Philippine law.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with the Anti-Money Laundering Act and BIR requirements.
• Game activity records: Retained for three (3) years from the date of the relevant game session for dispute resolution and audit purposes, then anonymized or deleted.
• Support communications: Retained for two (2) years from the date of the last relevant communication, unless the content is relevant to an ongoing legal matter.
• Marketing preferences and consent records: Retained for three (3) years from the date of last engagement or until consent is withdrawn, whichever is earlier.

Following the expiry of the applicable retention period, nurtar will securely delete or irreversibly anonymize your personal data. Anonymized data (which can no longer be used to identify you) may be retained indefinitely for statistical and analytical purposes.

8.1 Dormant Accounts

If your nurtar account is inactive for a continuous period of 12 months, nurtar will notify you by email and provide a 30-day window to reactivate the account. If the account remains inactive, it will be closed in accordance with nurtar's dormant account policy, and the personal data retention periods above will begin from the closure date.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by nurtar:

Exercising Your Rights

To exercise any of these rights, submit a written request to nurtar's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." Include your full name as registered on your nurtar account, a description of the right you wish to exercise, and any supporting information that will help nurtar locate and act on your request.

nurtar will acknowledge your request within 5 business days and provide a substantive response within 15 business days. Where the complexity or volume of requests requires additional time, nurtar will notify you and provide an extended response date, not to exceed 30 business days in total.

nurtar will not charge a fee for processing data subject rights requests unless requests are manifestly unfounded, repetitive, or excessive, in which case nurtar may charge a reasonable administrative fee or refuse to act on the request, providing written reasons in either case.

Right to File a Complaint

If you believe nurtar has processed your personal data in violation of the Philippine Data Privacy Act, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines. You are encouraged to contact nurtar's DPO first to attempt resolution before escalating to the NPC.

nurtar is an age-restricted gaming platform. Access is restricted to individuals who are at least 21 years of age in compliance with PAGCOR's minimum age requirements for casino-style gaming in the Philippines.

nurtar does not knowingly collect personal data from individuals under 21 years of age. If nurtar becomes aware that personal data has been collected from a person under the minimum age requirement, the account will be immediately suspended, the personal data will be deleted from nurtar's active systems (subject to any legal retention obligations), and where required, the matter will be referred to PAGCOR.

If you are a parent or guardian and believe that a minor has created a nurtar account using your or their own details, please contact nurtar's Support team at [email protected] immediately. nurtar takes underage access extremely seriously and will act on verified reports without delay.

With your consent, nurtar may send you marketing communications about promotions, bonuses, new game releases, and other offers relevant to your nurtar account. Marketing communications are sent via email, SMS, and in-platform notifications.

You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email from nurtar;
• Updating your notification preferences in your nurtar account settings;
• Sending an opt-out request to [email protected] with the subject line "Unsubscribe."

Opting out of marketing communications does not affect transactional communications — nurtar will continue to send you account-related messages such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These are necessary for the management of your account and cannot be disabled.

Players who have activated self-exclusion through nurtar's responsible gaming tools are automatically removed from all marketing communications for the duration of their exclusion period.

nurtar's primary data storage infrastructure is located within the Philippines. Certain service providers engaged by nurtar, including cloud infrastructure providers and some game content providers, may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, nurtar ensures that appropriate safeguards are in place in accordance with the Data Privacy Act and the National Privacy Commission's guidelines on cross-border data transfers. These safeguards include:

• Standard contractual clauses (data transfer agreements) incorporating the data protection obligations required by Philippine law;
• Transfer to jurisdictions recognized by the NPC as providing an adequate level of data protection;
• Binding corporate rules where data is transferred within a corporate group that nurtar's service provider belongs to.

You may request information about the specific safeguards applicable to any particular international transfer of your personal data by contacting nurtar's Data Protection Officer.

nurtar reserves the right to update this Privacy Policy from time to time to reflect changes in law, PAGCOR requirements, business practices, or the features of the nurtar platform. Material changes — meaning changes that significantly affect how nurtar processes your personal data or your rights — will be communicated to you by email to your registered address at least 14 days before the change takes effect.

Non-material changes, such as typographical corrections or clarifications that do not alter the substance of our data practices, may be published to this page without prior notice. The "Effective Date" at the top of this policy will always reflect the date of the most recent update.

We encourage you to review this Privacy Policy periodically. Continued use of the nurtar platform following the effective date of any update constitutes your acknowledgment of the revised policy. If you do not agree with the revised policy, you may close your account and request deletion of your personal data in accordance with Section 9.

If you have any questions, concerns, or requests relating to this Privacy Policy or nurtar's data processing practices, please contact nurtar's Data Protection Officer:

When contacting nurtar regarding a data privacy matter, please provide your registered account username and a clear description of your request or concern. This helps the DPO process your request efficiently within the required response timeframe.