nustal Privacy Policy

1 Introduction

nustal ("we," "us," or "our") is committed to protecting the privacy and personal data of every individual who interacts with our platform. This Privacy Policy describes, in plain and transparent terms, how nustal collects, processes, stores, and shares personal information in connection with the operation of our online gaming platform at nustal.net.

This policy is prepared in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects our obligations under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR), which requires us to maintain appropriate records and perform identity verification on all registered players.

This Privacy Policy applies to all personal data collected through the nustal website (nustal.net), mobile interfaces, customer support communications, and any other channel through which you interact with nustal. It does not apply to third-party websites or services that may be linked from our platform.

If you are a resident of Metro Manila, Cebu, Davao, Quezon City, Makati, or anywhere else in the Philippines — this policy applies to you and your personal information in equal measure.

2 Data Controller Information

For the purposes of the Data Privacy Act of 2012, nustal acts as the Personal Information Controller (PIC) in respect of all personal data collected through the platform. As PIC, nustal determines the purposes and means by which your personal information is processed.

nustal has appointed a Data Protection Officer (DPO) in accordance with NPC requirements. The DPO is responsible for overseeing our data protection compliance program, handling data subject requests, and serving as the primary point of contact for NPC inquiries. Contact details for the DPO are provided in Section 14 of this policy.

Where nustal engages third-party service providers to process data on its behalf — such as payment processors or game platform providers — those parties act as Personal Information Processors (PIP) under written agreements that bind them to process data solely on nustal's documented instructions and to maintain equivalent security standards.

3 Personal Data We Collect

nustal collects personal information through several channels, including registration forms, KYC document submissions, payment transactions, customer support interactions, and automated technical collection when you use the platform. The categories of personal data we collect are set out in the table below.

4 How We Use Your Personal Data

nustal processes your personal data for specific, legitimate purposes that are directly connected to providing a safe, compliant, and high-quality online gaming experience. We do not process your data for any purpose incompatible with those listed below:

• Account Creation and Management: To register your account, verify your identity, and maintain your player profile on the nustal platform.
• KYC and Age Verification: To comply with PAGCOR requirements and Philippine AML law, and to enforce the mandatory 21+ age restriction applicable to all nustal players.
• Payment Processing: To facilitate deposits via GCash, PayMaya, BDO, BPI, Metrobank, UnionBank, and InstaPay, and to process withdrawal requests to your verified payment account.
• Regulatory Compliance: To meet reporting obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and related Philippine legislation.
• Fraud Prevention and Security: To detect, investigate, and prevent unauthorized account access, financial fraud, bonus abuse, and other prohibited conduct on the platform.
• Responsible Gaming: To monitor player activity for signs of problem gambling and to administer deposit limits, cooling-off periods, and self-exclusion requests in line with nustal's Responsible Gaming Policy.
• Customer Support: To respond to your queries, complaints, and formal disputes in a timely and effective manner.
• Platform Improvement: To analyze aggregated, anonymized usage data for the purpose of improving platform performance, game selection, and user experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform news — but only where you have provided explicit consent. You may withdraw this consent at any time through your Account settings.

5 Legal Bases for Processing

Under the Data Privacy Act of 2012, nustal relies on the following legal bases when processing your personal information:

• Contractual Necessity: Processing required to perform the contract between you and nustal — specifically to operate your gaming account, process payments, and deliver the services you have requested.
• Legal Obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act itself, and other applicable Philippine law.
• Legitimate Interests: Processing necessary for nustal's legitimate business interests — including fraud detection, security monitoring, and platform analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing purposes, where we have obtained your clear, affirmative consent at registration or through your Account settings. You may withdraw consent at any time without affecting the legality of prior processing.

6 Sharing Your Personal Data

nustal may share your personal data with the following categories of third parties, strictly for the purposes described in Section 4:

6.1 Regulatory Authorities

nustal is legally required to share certain player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities upon lawful demand. We will notify you of such disclosures where legally permissible to do so.

6.2 Payment Processors

To process deposits and withdrawals, nustal shares the minimum necessary financial and identity data with licensed Philippine payment processors and e-wallet providers, including GCash (Mynt), PayMaya (Voyager), and partner banks such as BDO, BPI, Metrobank, and UnionBank. These parties are bound by their own NPC-registered privacy policies and applicable BSP regulations.

6.3 Game Platform Providers

Game content on nustal is supplied by licensed third-party game providers. These providers may receive anonymized or pseudonymized session data necessary to deliver and audit game outcomes. They do not receive your full identity or financial information.

6.4 IT and Security Service Providers

nustal engages reputable technology and cybersecurity vendors to operate platform infrastructure, conduct penetration testing, and provide fraud detection services. All such vendors operate under data processing agreements that bind them to process data solely on nustal's instructions and to maintain standards at least equivalent to those set out in this policy.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of nustal's assets, your personal data may be transferred to the successor entity. You will be notified in advance of any such transfer and of any material change to the applicable privacy policy.

7 Cookies & Tracking Technologies

nustal uses cookies and similar tracking technologies on the platform for purposes of session management, security, analytics, and user experience optimization. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: These cookies are required for the platform to function and cannot be disabled. They manage your login session, maintain your cart and balance state, and protect against cross-site request forgery (CSRF) attacks.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players navigate and use the platform. This data helps nustal improve platform performance and user experience. Analytics data does not identify you personally.
• Preference Cookies: Store your platform preferences such as language settings, notification preferences, and responsible gaming tool configurations.
• Security Cookies: Used by nustal's fraud detection systems to identify anomalous access patterns and protect your account from unauthorized use.

You may manage or disable non-essential cookies through your browser settings at any time. However, disabling strictly necessary cookies will prevent you from accessing your nustal Account. A cookie consent mechanism is presented upon first access to the platform and your preferences are recorded and respected for subsequent sessions.

8 Data Retention

nustal retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The general retention periods applicable to each data category are outlined below:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that renders re-identification impossible. Anonymized data may be retained indefinitely for statistical and analytical purposes.

9 Security Measures

nustal implements a multi-layered technical and organizational security framework to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Key security measures in place include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your device and nustal servers.
• Access Controls: Role-based access controls (RBAC) ensure that only authorized nustal personnel with a documented need can access personal player data. All access is logged and subject to audit.
• Two-Factor Authentication: nustal supports SMS OTP two-factor authentication for all player accounts and mandates 2FA for all internal administrative access to production systems.
• Penetration Testing: nustal engages independent security firms to conduct regular penetration tests and vulnerability assessments on the platform.
• Data Minimization: Systems are configured to collect and retain only the minimum data necessary, reducing the potential impact of any security incident.
• Employee Training: All nustal staff who handle personal data undergo regular data privacy and security awareness training aligned with NPC guidelines.
• Incident Response: nustal maintains a documented Data Breach Response Plan. In the event of a breach, nustal will notify affected players and the NPC within 72 hours, in compliance with NPC Circular 16-03.

10 Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal information held by nustal. These rights may be exercised by contacting nustal's Data Protection Officer as described in Section 14.

nustal will respond to all data subject requests within fifteen (15) business days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further fifteen (15) days, in which case we will notify you of the extension and the reasons for it.

11 Children's Privacy

If nustal becomes aware that personal data has been collected from an individual below the age of 21 — whether through a misrepresentation at registration or any other means — the following actions will be taken immediately:

• The associated account will be permanently suspended.
• All personal data related to the underage individual will be deleted from nustal's systems as quickly as our regulatory retention obligations permit.
• Any funds in the account will be handled in accordance with PAGCOR directives applicable to underage gambling incidents.
• The incident will be reported to PAGCOR as required under the applicable regulatory framework.

If you are a parent or guardian and believe that a person under 21 has registered on the nustal platform, please contact our DPO immediately using the contact details in Section 14. We will investigate and take appropriate action without delay.

12 Cross-Border Data Transfers

nustal's primary data processing infrastructure is located within the Philippines. However, some of the third-party service providers we engage — particularly game platform providers and certain cybersecurity vendors — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, nustal ensures that such transfers are conducted in compliance with Section 21 of the Data Privacy Act of 2012 and NPC guidelines on cross-border data transfers. Specifically, nustal requires that:

• The recipient country provides an adequate level of protection for personal data, as assessed by the NPC, or
• The transfer is governed by binding contractual clauses, standard contractual agreements, or equivalent safeguards that impose data protection obligations on the recipient at least equivalent to those under Philippine law.

You may request information about the specific safeguards in place for cross-border transfers involving your data by contacting our Data Protection Officer.

13 Updates to This Privacy Policy

nustal reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, amendments to Philippine privacy law, new NPC issuances, or updates to PAGCOR regulations. The current version of the policy is always available at nustal.net/privacy-policy and is identified by the effective date shown at the top of the document.

When material changes are made to this policy, nustal will notify registered players through one or more of the following channels: a prominent platform notice, an email to your registered address, or an in-account notification. Your continued use of the nustal platform following notification of material changes constitutes your acknowledgment of the updated policy.

We encourage you to review this page periodically so that you remain informed about how nustal protects your personal information.

14 Contact & Data Protection Officer

For all data privacy inquiries, data subject access requests, or concerns regarding nustal's handling of your personal information, please contact our designated Data Protection Officer:

When submitting a data subject request, please include your full name, registered email address, and a clear description of the request or concern. nustal may request proof of identity before processing any access, rectification, or erasure request to protect your data from unauthorized third-party requests.

If you remain unsatisfied with nustal's handling of your data privacy concern after contacting our DPO, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through official NPC channels.