m8k8 Privacy Policy

m8k8 is the data controller responsible for the personal information processed in connection with the m8k8 platform. m8k8 operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR) and is bound by the Data Privacy Act of 2012 and all applicable NPC issuances in its capacity as a personal information controller.

Questions and requests relating to this Privacy Policy should be directed to m8k8's Data Protection Officer as specified in Section 15 of this Policy.

This Policy applies to all personal data that m8k8 processes in connection with the following:

• Registration and maintenance of m8k8 player accounts;
• KYC identity verification and anti-money laundering compliance;
• Deposits, withdrawals, and all financial transactions conducted through the platform;
• Gameplay activity, session data, and game history;
• Participation in promotions, loyalty programs, and VIP schemes;
• Customer support interactions conducted via live chat, email, or other channels;
• Communications and marketing, where consented to by the Player;
• Access to the m8k8.vip website by any visitor, whether registered or not.

m8k8 collects only the personal data that is necessary for the purposes described in this Policy. The categories of data we collect are set out in the table below.

m8k8 does not collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, political affiliation, or religious belief) beyond what may be incidentally disclosed during support interactions or KYC processes required by PAGCOR.

m8k8 collects personal data through the following methods:

• Direct provision: Information you provide when registering, completing KYC, submitting deposit or withdrawal requests, or contacting support;
• Automated collection: Technical data collected automatically through cookies, session tracking, and server logs when you access m8k8.vip;
• Third-party sources: Identity verification data from licensed KYC service providers; transaction confirmation data from payment providers including GCash, PayMaya, BPI, BDO, and Metrobank; and fraud screening data from licensed anti-fraud services;
• PAGCOR and regulatory sources: In limited circumstances, data may be received from PAGCOR or other Philippine regulatory authorities in connection with licensing, compliance, or enforcement obligations.

m8k8 processes personal data only where there is a lawful basis to do so under the Data Privacy Act of 2012. The applicable legal bases for m8k8's data processing activities are:

• Contractual necessity: Processing of identity, contact, financial, and gaming activity data is necessary for the performance of the contract between you and m8k8 — specifically, to operate your account and provide gaming services;
• Legal obligation: Processing of KYC, transaction, and gaming activity data is required to comply with PAGCOR licensing conditions, Republic Act No. 9160 (Anti-Money Laundering Act), and other applicable Philippine laws;
• Legitimate interests: Processing of technical data for security, fraud detection, and platform optimisation, where such interests are not overridden by your data protection rights;
• Consent: Processing of data for direct marketing and promotional communications, where you have provided explicit opt-in consent. You may withdraw marketing consent at any time through your account settings without affecting the lawfulness of prior processing.

m8k8 uses personal data for the following specific purposes:

• Creating, operating, and maintaining your m8k8 player account;
• Verifying your identity and age in compliance with PAGCOR KYC requirements and the minimum age requirement of 21 years;
• Processing deposits, managing your PHP balance, and executing withdrawal requests to your verified payment accounts;
• Monitoring gaming activity for responsible gaming purposes, including identifying patterns that may indicate problem gambling and applying applicable tool restrictions;
• Detecting and preventing fraud, money laundering, account takeover, bonus abuse, and other prohibited conduct under m8k8's Terms and Conditions;
• Providing customer support and resolving disputes or complaints;
• Communicating with you regarding your account, including security alerts, transaction confirmations, and updates to terms;
• Sending promotional communications and personalised offers where you have opted in to receive them;
• Complying with PAGCOR reporting requirements, AML obligations, and any instruction from a Philippine regulatory authority or court;
• Improving the m8k8 platform through anonymised analytics and performance monitoring.

m8k8 shares personal data only in the following limited circumstances, and only to the extent necessary for each purpose:

• Payment providers: Your name and transaction reference information are shared with GCash, PayMaya, BPI, BDO, Metrobank, or other payment providers to process deposits and withdrawals. These providers are contractually bound to process your data only for payment execution purposes.
• KYC and identity verification services: Identity documents and biometric data submitted during KYC are processed by licensed verification service providers acting as data processors under m8k8's instruction.
• Fraud and AML screening services: Transaction and identity data may be processed by licensed anti-fraud and AML screening services to fulfil m8k8's obligations under Philippine AML law.
• PAGCOR and regulatory authorities: m8k8 is required to provide gaming activity data, financial transaction records, and player information to PAGCOR and other Philippine regulatory and law enforcement authorities upon lawful request.
• Game content providers: Limited technical session data (not your full identity) may be shared with licensed game providers to support game delivery, session integrity, and dispute resolution for specific game rounds.
• Professional advisers: Legal, audit, and compliance advisers engaged by m8k8 may have access to personal data subject to professional confidentiality obligations.

m8k8 retains personal data only for as long as necessary for the purposes for which it was collected, subject to the following minimum retention periods required by applicable law:

After the applicable retention period, personal data is securely deleted or anonymised using methods that prevent reconstruction of the original data.

m8k8 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and m8k8 is encrypted using TLS 1.3 with 256-bit AES encryption. Data at rest is encrypted using AES-256 across all storage systems.
• Access controls: Access to personal data within m8k8 is restricted on a strict need-to-know basis. All internal access is logged and audited.
• Two-factor authentication: m8k8 staff accessing administrative systems are required to use multi-factor authentication. Players are strongly encouraged to enable 2FA on their accounts.
• Penetration testing: m8k8's platform undergoes regular third-party security assessments to identify and remediate vulnerabilities before they can be exploited.
• KYC document handling: Government ID images and biometric data submitted during KYC are processed by accredited verification providers and are not stored in raw form on m8k8 servers beyond the verification window.
• Staff training: All m8k8 staff with access to personal data receive mandatory data privacy training under the requirements of the DPA implementing rules.

m8k8 uses cookies and similar tracking technologies on the m8k8.vip website for the following purposes:

• Strictly necessary cookies: Required for the platform to function — including session management, authentication state, and security tokens. These cannot be disabled without rendering core platform features non-functional.
• Functional cookies: Store your preferences such as language settings and display options to improve your experience across sessions.
• Analytics cookies: Collect anonymised data about how visitors use the platform to help m8k8 improve page performance and game lobby layout. IP addresses are anonymised before processing.
• Security cookies: Support fraud detection and bot prevention systems to protect your account and the integrity of the platform.

m8k8 does not use third-party advertising cookies or cross-site tracking technologies. No cookie data collected on m8k8.vip is shared with advertising networks.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using core account features. Your cookie preferences are saved for 12 months from the date of last interaction.

The m8k8 platform is strictly intended for persons aged 21 and above. m8k8 does not knowingly collect, process, or retain personal data from individuals under 21 years of age. m8k8's age verification systems are designed to identify and reject registration attempts by minors.

If m8k8 becomes aware that personal data has been collected from a person under 21 — whether through a false declaration during registration or any other means — m8k8 will:

• Immediately close the relevant account;
• Delete all personal data associated with the account to the extent permitted by law;
• Deal with any funds held in the account in accordance with PAGCOR guidance and applicable law;
• Report the matter to PAGCOR and, where required, to the relevant child protection authority.

To exercise any of the rights described in the "Your Data Rights" section of this Policy — including access, rectification, erasure, objection, or portability — submit a request to m8k8's Data Protection Officer using the contact details in Section 15.

The following process applies to all data rights requests:

1. Submit your request in writing, including your full name, registered email address, and a description of the specific right you wish to exercise;
2. m8k8 will acknowledge receipt of your request within 3 business days;
3. Identity verification may be required before m8k8 can act on the request — you may be asked to confirm your identity using your registered contact details or KYC documents;
4. m8k8 will respond substantively to your request within 15 business days. If more time is required, m8k8 will notify you of the expected timeframe;
5. If your request is declined in whole or in part, m8k8 will provide written reasons for the decision;
6. If you are not satisfied with m8k8's response, you may escalate your complaint to the National Privacy Commission of the Philippines.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected data subjects, m8k8 will:

• Conduct immediate internal containment and assessment of the breach;
• Notify the National Privacy Commission within 72 hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03;
• Notify affected account holders promptly by email to their registered address, providing details of the nature of the breach, the data categories involved, the likely consequences, and the remedial steps m8k8 has taken or proposes to take;
• Take all reasonable steps to contain the breach, prevent further unauthorised access, and restore the integrity of affected systems.

Players who suspect unauthorised access to their m8k8 account should contact support immediately to initiate an account lock pending investigation.

m8k8 may update this Privacy Policy from time to time to reflect changes in law, PAGCOR requirements, NPC guidance, or m8k8's data processing practices. The "Last Updated" date at the top of this Policy indicates when the most recent revision took effect.

When material changes are made, m8k8 will notify registered account holders by email to their registered address with a minimum of 7 days' advance notice before the changes take effect. A summary of key changes will be included in the notification.

Continued use of the m8k8 platform following the effective date of an updated Policy constitutes acceptance of the revised terms. Players who do not accept the updated Policy should cease using the platform and contact support to close their account.

m8k8 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. All data privacy queries, rights requests, and complaints should be directed to the DPO using the following contact information:

m8k8 is committed to resolving all data privacy concerns at the first point of contact where possible. If your concern is not resolved to your satisfaction through the DPO channel, you retain the right to escalate to the NPC at any time.