nurtstar Privacy Policy

1 Introduction

1.1 nurtstar is the Philippines' trusted online casino and sports betting platform, serving Filipino players across Manila, Cebu, Davao, Quezon City, and communities nationwide. As a platform that handles real-money transactions and personally identifiable information, we take data privacy seriously — not as a compliance exercise, but as a genuine commitment to the Filipino players who trust us with their information.

1.2 This Privacy Policy applies to all personal data collected through the nurtstar Platform, including but not limited to: the account registration process, the Know Your Customer (KYC) identity verification process, deposit and withdrawal transactions via GCash, Maya, BPI, BDO, and Metrobank, gameplay activity, customer support interactions, and marketing communications.

1.3 This Policy should be read alongside the nurtstar Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with the nurtstar Platform.

2 Data Controller

2.1 For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, nurtstar is the personal information controller (PIC) responsible for the personal data collected through the nurtstar Platform.

2.2 nurtstar has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. The DPO may be contacted at [email protected] with the subject line "Data Protection Officer / Privacy Request." Contact details are also provided in Section 16 of this Policy.

2.3 Where nurtstar engages third-party service providers to process personal data on its behalf — such as KYC verification partners, payment processors, and fraud prevention services — those parties act as personal information processors (PIPs) under written agreements that impose data protection obligations consistent with this Policy and applicable law.

3 Personal Data We Collect

3.1 nurtstar collects personal data through several points of interaction with the Platform. The categories of personal data we collect, and the context in which they are collected, are described below.

3.1 Registration Data

When you register an Account on nurtstar, we collect: your full legal name; date of birth; residential address; registered Philippine mobile number; email address; and the username and password you create. This information is necessary to create and manage your Account.

3.2 Identity Verification (KYC) Data

To comply with applicable gaming regulations and to verify your identity and age (21+), nurtstar collects: images of your government-issued Philippine identification document (both sides); a real-time liveness selfie captured through our biometric verification tool; and, where applicable, proof of your registered payment method. KYC data is processed and stored with enhanced security controls.

3.3 Financial & Transaction Data

nurtstar records all deposit and withdrawal transactions, including: payment method details (e.g., GCash mobile number, bank account reference); transaction amounts and timestamps; deposit and withdrawal history; and bonus credit and usage records. Full payment card numbers, if applicable, are handled exclusively by our PCI-DSS-certified payment processors and are never stored on nurtstar's own systems.

3.4 Gaming Activity Data

We collect data on your in-platform gaming activity, including: games played; wager amounts and outcomes; session start and end times; betting history in the sportsbook; and VIP tier activity. This data is used for account management, fraud detection, responsible gaming monitoring, and regulatory reporting.

3.5 Technical & Device Data

When you access the Platform, we automatically collect certain technical information, including: your IP address and approximate geolocation; browser type and version; device type and operating system; session identifiers; and platform interaction data (e.g., pages visited, time on page). This data is used for security monitoring, fraud prevention, and Platform optimisation.

3.6 Communications Data

Records of your communications with nurtstar's customer support team — including live chat transcripts, email exchanges, and, where applicable, call recordings — are retained for quality assurance, training, and dispute resolution purposes.

4 How We Use Your Personal Data

4.1 nurtstar uses the personal data we collect for the following purposes:

4.2 nurtstar does not use your personal data for automated decision-making processes that produce legal or similarly significant effects without human review, except where required by applicable law or where you have provided explicit consent.

5 Legal Basis for Processing

5.1 nurtstar processes personal data under the following legal bases as provided by the Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Consent: For processing that is not strictly necessary for the performance of a contract or compliance with a legal obligation — principally marketing communications — nurtstar obtains your explicit, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Contractual Necessity: Processing required to perform our obligations under the nurtstar Terms & Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with Philippine law, including anti-money laundering (AML) obligations, gaming regulatory requirements, and mandatory KYC procedures.
• Legitimate Interests: Processing for purposes where nurtstar has a legitimate business interest that is not overridden by your fundamental rights, including fraud prevention, network security, and Platform improvement.

6 Sharing Your Personal Data

6.1 nurtstar may share your personal data with third parties only in the following circumstances and only to the extent necessary for each specified purpose:

• Payment Processors: GCash (G-Xchange Inc.), Maya Philippines Inc., and banking partners (BPI, BDO, Metrobank) receive transaction data necessary to process deposits and withdrawals. These parties are independent data controllers for their own processing activities, subject to their own privacy policies.
• KYC and Identity Verification Providers: Third-party identity verification services that process your government-issued ID images and liveness selfie to verify your identity and age. These providers act as personal information processors under contractual data protection obligations.
• Fraud Prevention and Security Services: We share technical and behavioural data with fraud detection platforms to identify and prevent account fraud, money laundering, and unauthorised access.
• Regulatory Authorities: nurtstar may be required by Philippine law to disclose personal data to government authorities, including the Anti-Money Laundering Council (AMLC), National Privacy Commission (NPC), and other competent Philippine regulatory bodies, where required by applicable law or court order.
• Professional Advisors: Legal counsel, auditors, and professional advisors may access personal data where necessary in the course of their professional services, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of nurtstar's assets, your personal data may be transferred to the successor entity, subject to the same privacy protections as described in this Policy.

6.2 All third-party processors engaged by nurtstar are subject to written data processing agreements that impose obligations at least equivalent to those required by the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

7 Cookies and Tracking Technologies

7.1 nurtstar uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain session security, and analyse Platform performance. The categories of cookies used are described below.

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in and security tokens. These cannot be disabled without rendering the Platform non-functional.
• Functional Cookies: Remember your preferences such as language settings, game history, and UI customisations to improve your experience across sessions.
• Analytics Cookies: Collect aggregated and anonymised data about how players navigate the Platform, which pages are most visited, and where technical errors occur. This data is used to improve Platform performance and user experience.
• Security and Fraud Prevention Cookies: Assist in detecting and preventing fraudulent account activity, bot activity, and suspicious login attempts.

7.2 You may manage cookie preferences through your browser settings. Disabling functional or analytics cookies will not prevent access to the Platform but may affect some personalisation features. Disabling strictly necessary cookies may prevent certain Platform functions from operating correctly.

7.3 nurtstar does not use third-party advertising cookies or tracking technologies that share your data with advertising networks for the purpose of targeting advertisements on other websites.

8 Data Retention

8.1 nurtstar retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and thereafter for as long as required by applicable Philippine law or regulatory requirements.

• Account and Registration Data: Retained for the duration of your Account and for a minimum of five (5) years following Account closure, in accordance with applicable anti-money laundering record-keeping requirements.
• KYC and Identity Verification Data: Retained for a minimum of five (5) years following Account closure or the date of the most recent transaction, in accordance with AML regulations.
• Financial and Transaction Records: Retained for a minimum of five (5) years in accordance with applicable financial record-keeping obligations under Philippine law.
• Gaming Activity Data: Retained for a minimum of three (3) years following Account closure for regulatory compliance and dispute resolution purposes.
• Customer Support Communications: Retained for a minimum of two (2) years for quality assurance and dispute resolution purposes.
• Technical and Device Data: Retained for a maximum of twelve (12) months following the end of the associated session, unless retained longer for fraud investigation purposes.

8.2 Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with nurtstar's data disposal procedures.

9 Data Security

9.1 nurtstar implements technical and organisational measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and nurtstar's servers;
• Encryption of sensitive data fields (including passwords, which are hashed using industry-standard algorithms and never stored in plain text) at rest;
• PCI-DSS compliant payment processing — full card numbers are processed exclusively by certified payment processors and are never stored on nurtstar's systems;
• Two-factor authentication (2FA) available to all Players and recommended for all Accounts;
• Automated fraud detection and account monitoring systems operating around the clock;
• Role-based access controls ensuring that nurtstar staff access only the minimum personal data necessary to perform their specific functions;
• Regular security audits and penetration testing conducted by independent cybersecurity professionals.

9.2 While nurtstar employs industry-standard security measures, no system of data transmission over the internet or electronic storage is entirely secure. Players are responsible for maintaining the security of their own Account credentials, including their password and 2FA recovery codes.

10 Your Data Subject Rights

10.1 Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, Filipino players have the following rights with respect to their personal data held by nurtstar. To exercise any of these rights, contact nurtstar's Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request." nurtstar will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days.

11 Children's Privacy and Minors

11.1 The nurtstar Platform is strictly restricted to individuals who are at least twenty-one (21) years of age. nurtstar does not knowingly collect personal data from individuals under the age of 21.

11.2 The 21+ age requirement is enforced through mandatory KYC identity verification for all Players. Any Account found to have been registered by a person under 21 years of age will be immediately closed, and any remaining balance will be refunded to the deposit source. In such cases, nurtstar will delete the personal data of the underage individual beyond what is required for regulatory record-keeping purposes.

11.3 If you believe a minor has accessed or registered with the nurtstar Platform, please contact us immediately at [email protected]. We will investigate and take appropriate action without delay.

12 Marketing Communications

12.1 nurtstar sends marketing communications — including promotional offers, bonus notifications, and Platform updates — only to Players who have provided their explicit, affirmative consent to receive such communications during the registration process or through their Account communication preferences.

12.2 You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" or "Opt Out" link in any marketing email sent by nurtstar;
• Updating your communication preferences in the nurtstar Account Settings;
• Contacting nurtstar support at [email protected] with the request "Opt Out of Marketing."

12.3 Opting out of marketing communications does not affect nurtstar's ability to send you transactional communications that are necessary for account management, such as deposit confirmation, withdrawal processing notices, and security alerts. These communications are not marketing and cannot be disabled while your Account remains active.

13 Third-Party Services and Links

13.1 The nurtstar Platform integrates third-party services for core functionality, including payment processing (GCash, Maya, BPI, BDO, Metrobank), identity verification, and game content delivery. These third-party services operate under their own privacy policies and data practices, for which nurtstar is not responsible.

13.2 nurtstar does not embed or link to third-party social media platforms, advertising networks, or external content providers within the core gaming Platform in a manner that would allow those parties to collect personal data about nurtstar players without disclosure.

13.3 Payment providers such as GCash and Maya are independent data controllers for the personal data they process in the course of payment transactions. Players are encouraged to review the privacy policies of their chosen payment providers for details of how those providers handle personal data.

14 International Data Transfers

14.1 nurtstar's primary data processing infrastructure is located within the Philippines. Where the engagement of third-party service providers requires the transfer of personal data to servers or processors located outside the Philippines, nurtstar ensures that such transfers are made only:

• To jurisdictions that the National Privacy Commission recognises as providing adequate levels of data protection;
• Subject to binding contractual clauses that impose data protection obligations equivalent to those required under Philippine law; or
• With your explicit consent, where other safeguards are not applicable.

14.2 nurtstar will not transfer your personal data internationally in circumstances that would compromise the protections to which you are entitled under the Data Privacy Act of 2012.

15 Amendments to This Privacy Policy

15.1 nurtstar reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

15.2 For material amendments that significantly affect your rights or the way nurtstar processes your personal data, nurtstar will provide at least fourteen (14) days' advance notice by email to your registered address and/or by a prominent in-platform notice.

15.3 Your continued use of the Platform following the effective date of an amended Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any amendment, you should cease using the Platform and may request Account closure before the amended Policy takes effect.

16 Contact & Data Protection Officer

16.1 If you have questions, concerns, or requests relating to this Privacy Policy or nurtstar's data processing practices, please contact us through the following channels:

16.2 nurtstar's DPO will acknowledge data privacy requests within five (5) business days and will provide a substantive written response within thirty (30) calendar days. Complex requests involving large volumes of data or third-party coordination may require an extension, which will be communicated to you.

16.3 If you are not satisfied with nurtstar's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters under the Data Privacy Act of 2012.