mdrplay Privacy Policy

01 Who We Are

mdrplay is an online casino and sports betting platform operating under PAGCOR authorization for the Philippine market, accessible at https://mdrplay.bet. mdrplay serves Filipino players across the Philippines, including but not limited to players in Metro Manila, Cebu, Davao, Quezon City, Makati, and other provinces and regions throughout the archipelago.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), mdrplay acts as the Personal Information Controller (PIC) with respect to the personal data of its players and website visitors. mdrplay is responsible for determining the purposes and means of processing personal data collected through the Platform.

All data processing activities carried out by mdrplay are subject to the Data Privacy Act of 2012, its Implementing Rules and Regulations, and all applicable circulars and issuances of the National Privacy Commission of the Philippines.

02 Personal Data We Collect

mdrplay collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is collected. The categories of personal data we collect include the following:

mdrplay does not intentionally collect sensitive personal information beyond what is required for identity verification and regulatory compliance. Where sensitive personal information is necessarily collected (such as government ID numbers), it is processed with heightened security controls and access restrictions.

03 How We Collect Your Data

mdrplay collects personal data through the following means:

• Direct Submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you access or use the mdrplay Platform, including IP address, device identifiers, browser type, session timestamps, and interaction logs, collected via cookies, log files, and similar tracking technologies.
• Payment Providers: Transaction confirmation data shared by GCash, Maya, BPI, BDO, Metrobank, and other payment partners when you initiate or complete a financial transaction on mdrplay.
• Third-Party Verification Services: Identity and document verification data from KYC service providers engaged by mdrplay to assist in fulfilling PAGCOR-mandated player verification requirements.
• Game Providers: Aggregated gaming activity data from certified game providers whose products are integrated into the mdrplay Platform.
• Regulatory Authorities: In limited circumstances, mdrplay may receive data from PAGCOR or other Philippine authorities in connection with regulatory compliance obligations.

04 How We Use Your Personal Data

mdrplay processes personal data solely for lawful, specified, and legitimate purposes. The primary purposes for which we use your data are as follows:

• Account Management: Creating, verifying, maintaining, and administering your mdrplay account, including processing registration, managing account balances, and handling account closure requests.
• Identity & Age Verification (KYC): Verifying that you are at least 21 years of age and are who you claim to be, as required by PAGCOR and Philippine gaming law.
• Transaction Processing: Processing deposits and withdrawals via GCash, Maya, InstaPay, and other accepted Philippine payment channels.
• Regulatory Compliance: Fulfilling legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and other applicable Philippine laws, including mandatory reporting to relevant authorities.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, cheating, collusion, bonus abuse, money laundering, and other prohibited conduct on the Platform.
• Customer Support: Responding to your enquiries, complaints, and support requests via live chat, email, or other support channels.
• Responsible Gaming: Monitoring gaming activity to identify signs of problem gambling, enforcing self-exclusion and deposit limit settings, and fulfilling responsible gaming obligations.
• Service Improvement: Analyzing aggregated and anonymized usage data to improve Platform performance, game offerings, and the overall player experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and relevant updates to players who have opted in to receive such communications. You may opt out at any time by contacting support.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, mdrplay processes personal data on one or more of the following legal bases:

• Consent: Where you have given your freely given, specific, informed, and unambiguous consent to the processing of your personal data for a specific purpose, such as the receipt of marketing communications.
• Contractual Necessity: Where processing is necessary for the performance of the contract between you and mdrplay — specifically, the Terms & Conditions governing your mdrplay account — such as processing transactions, managing account balances, and providing gaming services.
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which mdrplay is subject, including PAGCOR licensing requirements, AMLA reporting obligations, and KYC mandates.
• Legitimate Interests: Where processing is necessary for the purposes of the legitimate interests pursued by mdrplay, such as fraud prevention, platform security, and service improvement, provided that such interests do not override your fundamental rights and freedoms.

Where mdrplay relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

06 Sharing Your Personal Data

mdrplay does not sell, rent, or otherwise commercially exploit your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

• PAGCOR and Philippine Regulatory Authorities: mdrplay is required by law to share player data, gaming activity reports, and suspicious transaction reports with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities as mandated by applicable regulations.
• Payment Service Providers: Financial data is shared with GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, and 7-Eleven CLiQQ as necessary to process your deposits and withdrawals. These providers operate their own privacy policies and are bound by applicable Philippine financial regulations.
• KYC and Identity Verification Providers: Identity documents and verification data may be shared with third-party KYC service providers engaged by mdrplay to assist in fulfilling PAGCOR-mandated player verification requirements. Such providers are contractually bound to process data only for verification purposes.
• Game and Technology Providers: Limited technical and gaming activity data is shared with certified game providers and technology partners as necessary for the operation of gaming services and Platform infrastructure.
• Professional Advisors: Legal, financial, and compliance advisors may access player data on a strictly need-to-know basis in connection with mdrplay's legal and regulatory obligations, subject to professional confidentiality obligations.
• Law Enforcement: mdrplay may disclose personal data to Philippine law enforcement agencies where required by a valid legal order, court order, or where disclosure is necessary to prevent or investigate a serious crime.
• Business Transfers: In the event of a merger, acquisition, or transfer of mdrplay's business or assets, player data may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

07 Cookies & Tracking Technologies

mdrplay uses cookies and similar tracking technologies to enhance your experience on the Platform, ensure security, and collect analytical data. The types of cookies used by mdrplay include:

• Strictly Necessary Cookies: Essential for the operation of the mdrplay Platform, including session management, authentication, and security. These cookies cannot be disabled without affecting core Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymized data about how players interact with the Platform, including pages visited, session durations, and error reports. This data helps mdrplay improve the quality and performance of its services.
• Functionality Cookies: Allow the Platform to remember your preferences, such as language settings and responsible gaming limits, to provide a more personalized experience.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorized access, and bot traffic on the Platform.

You may manage cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality and security of the mdrplay Platform. mdrplay does not use third-party advertising or behavioral targeting cookies.

08 Data Security

mdrplay implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the mdrplay Platform.
• Encryption of sensitive data fields at rest within our databases, including payment information and identity document data.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scans conducted by qualified cybersecurity professionals.
• Multi-factor authentication requirements for administrative access to systems holding personal data.
• Continuous monitoring of Platform activity for anomalies, unauthorized access attempts, and suspicious behavior.
• Incident response procedures compliant with NPC breach notification requirements under the Data Privacy Act.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, mdrplay will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay where required by law.

09 Data Retention

mdrplay retains personal data for as long as is necessary to fulfill the purposes for which it was collected, subject to applicable legal and regulatory minimum retention periods. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active mdrplay account plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and AMLA record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction, in accordance with AMLA requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act and PAGCOR reporting standards.
• Gaming Activity Logs: Retained for a minimum of three (3) years for dispute resolution, regulatory audit, and responsible gaming monitoring purposes.
• Customer Support Records: Retained for two (2) years following the resolution of the relevant support interaction, except where the matter is subject to ongoing legal proceedings.
• Marketing Consent Records: Retained for the duration of your consent plus two (2) years thereafter as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or anonymized such that it can no longer be associated with any identifiable individual. Where full deletion is not immediately technically feasible, data is restricted from active use pending secure deletion.

10 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by mdrplay. To exercise any of these rights, please contact our Data Protection Officer at [email protected].

11 Children & Minors

The mdrplay Platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations and applicable Philippine gambling laws. mdrplay does not knowingly collect personal data from persons under the age of 21.

If mdrplay becomes aware that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended, all data associated with the account will be reviewed, and any deposited funds will be returned to the originating payment method. The data of the underage individual will be deleted as soon as practicable, subject to any mandatory reporting obligations to PAGCOR.

If you are a parent or guardian and believe your child under the age of 21 has registered an account on mdrplay, please contact our support team immediately at [email protected] or via live chat so that we can take prompt remedial action.

12 Cross-Border Data Transfers

In operating the mdrplay Platform, it may be necessary to transfer your personal data to third-party service providers or technology partners whose operations are located outside the Philippines — for example, certified game providers, cloud infrastructure providers, or KYC verification services with operations in other jurisdictions.

Where such cross-border transfers occur, mdrplay ensures that adequate safeguards are in place to protect your personal data in accordance with the requirements of the Philippine Data Privacy Act and the standards set by the National Privacy Commission. Safeguards may include:

• Contractual data processing agreements incorporating NPC-approved standard contractual clauses or equivalent protections.
• Transfer to jurisdictions that provide an adequate level of data protection as recognized by the NPC.
• Implementation of supplementary technical and organizational security measures where required.

mdrplay does not transfer personal data to jurisdictions where an adequate level of data protection cannot be assured without the player's informed consent, except where required by Philippine law or PAGCOR mandate.

13 Changes to This Privacy Policy

mdrplay reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform operations. Any material changes to this Policy will be communicated to registered players via their registered email address and/or via a prominent notice displayed upon login to the mdrplay Platform.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the mdrplay Platform following notification of any changes to this Policy constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you must discontinue use of the Platform and may request account closure in accordance with the procedures set out in the Terms & Conditions.

We encourage all mdrplay players to review this Privacy Policy periodically to stay informed about how we protect and use your personal data.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by mdrplay, you may contact us through the following channels:

• Live Chat: Available 24/7 inside the mdrplay Platform in both Tagalog and English. Average response time is 3–5 minutes.
• Email: [email protected] — for general support enquiries.
• DPO Contact: [email protected] — please use the subject line "Data Privacy Request" or "DPO Enquiry" for all data privacy-related correspondence.

mdrplay aims to acknowledge all data privacy requests within 48 hours and to provide a full response within 30 days. For complex requests, we will notify you of any required extension within the initial 30-day period.

If you are not satisfied with mdrplay's response to a data privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available at the NPC's official government website.