Privacy Policy — orionplay

1 Introduction and Scope

This Privacy Policy ("Policy") describes how orionplay ("orionplay," "we," "our," or "us") collects, uses, stores, discloses, and otherwise processes personal data about users ("you," "your," or "Player") of the orionplay website located at orionplay.bio and all associated services, games, and features (collectively, the "Platform").

orionplay is committed to protecting the privacy of all Filipino players and other individuals whose personal data we process. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA") and its Implementing Rules and Regulations (IRR), as well as applicable guidelines issued by the National Privacy Commission (NPC) of the Philippines.

By using the orionplay Platform — including by creating an account, making a deposit, placing a bet, or contacting our support team — you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein.

2 Data Controller Identity

The data controller responsible for your personal information in connection with the orionplay Platform is orionplay, accessible at orionplay.bio. orionplay operates under the PAGCOR regulatory framework and has registered its data processing activities with the National Privacy Commission of the Philippines, as required by the Data Privacy Act.

orionplay has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. You may contact the DPO at any time using the contact details provided in Section 14 of this Policy.

3 Personal Data We Collect

orionplay collects several categories of personal data in the course of operating its Platform. The categories and specific data types are set out in the table below:

4 How We Collect Your Data

orionplay collects personal data through the following methods:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, and server logs;
• Third-party sources: Identity verification services, payment processors (e.g., GCash, PayMaya), fraud prevention agencies, and PAGCOR compliance databases, where orionplay is legally authorised to receive such information.

5 Purposes and Legal Bases for Processing

orionplay processes your personal data for the following purposes, each supported by a lawful basis under the Philippine Data Privacy Act:

• Account creation and management — necessary for the performance of the contract between you and orionplay;
• Identity and age verification (KYC) — compliance with PAGCOR regulatory requirements and Philippine law;
• Payment processing and fraud prevention — compliance with AMLA (Republic Act 9160, as amended) and protection of legitimate interests;
• Responsible gaming monitoring — compliance with PAGCOR's responsible gaming framework and the Platform's duty of care to players;
• Customer support — performance of the service contract and legitimate business interests;
• Direct marketing and promotions — with your prior consent, where required by the DPA;
• Legal and regulatory compliance — fulfilment of obligations under Philippine law, PAGCOR requirements, and orders from competent authorities.

6 Disclosure of Personal Data

orionplay does not sell or rent your personal data to any third party for their independent commercial purposes. orionplay may share your personal data with the following categories of recipients, strictly as necessary and subject to appropriate data sharing agreements or legal authority:

• Payment service providers (e.g., GCash, PayMaya, BPI, BDO, InstaPay) — for deposit and withdrawal processing;
• KYC and identity verification partners — for age and identity verification as required by PAGCOR;
• Anti-fraud and security service providers — for fraud detection, risk scoring, and account security;
• PAGCOR and the Anti-Money Laundering Council (AMLC) — as required by Philippine gaming law and AMLA;
• IT and hosting service providers — who process data solely on orionplay's behalf and under strict data processing agreements;
• Law enforcement and courts — when required by valid legal process, court order, or applicable Philippine law.

7 Cookies and Tracking Technologies

orionplay uses cookies and similar tracking technologies on the Platform to ensure functionality, improve performance, personalise your experience, and support security operations. The categories of cookies used include:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management and authentication. These cannot be disabled.
• Performance Cookies: Collect anonymised data on how players use the Platform to help orionplay improve user experience.
• Functional Cookies: Remember your preferences, such as language settings and game display options.
• Security Cookies: Used by orionplay's fraud detection systems to identify unusual or suspicious behaviour patterns.

You may adjust your cookie preferences through your browser settings. Please note that disabling certain cookies may limit the functionality of the orionplay Platform.

8 Data Security Measures

orionplay implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and orionplay's servers;
• Encryption of sensitive data at rest, including payment details and identity documents;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication for all orionplay staff accessing systems that store personal data;
• Regular security audits, vulnerability assessments, and penetration testing;
• Incident response procedures aligned with NPC breach notification requirements under Section 20(f) of the DPA IRR.

Despite these measures, no system is entirely impenetrable. In the event of a personal data breach that is likely to give rise to a real risk to your rights and freedoms, orionplay will notify the NPC and affected individuals within the timeframes prescribed by Philippine law.

9 Data Retention

orionplay retains your personal data for the following periods, or longer where required by law:

• Active accounts: For the duration of your account and gaming relationship with orionplay;
• KYC and financial records: A minimum of five (5) years following account closure, as required by PAGCOR and AMLA;
• Support communications: Up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes;
• Marketing data: Until you withdraw your consent or request erasure, whichever is earlier.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

10 Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by orionplay:

• Right to be Informed: The right to know what personal data orionplay collects and how it is processed — as set out in this Policy;
• Right of Access: The right to obtain a copy of your personal data held by orionplay;
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected;
• Right to Erasure: The right to request deletion of your personal data, subject to legal retention obligations;
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format;
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) if you believe your data rights have been violated.

To exercise any of these rights, contact orionplay's Data Protection Officer at [email protected]. orionplay will respond to verifiable data subject requests within thirty (30) calendar days, as required by the DPA.

11 International Data Transfers

Some of orionplay's service providers, including certain cloud hosting and IT infrastructure partners, may process personal data outside the Philippines. In all such cases, orionplay ensures that appropriate safeguards are in place — including contractual data processing agreements incorporating DPA-standard protections — to ensure your data is afforded equivalent protection to that provided under Philippine law. orionplay will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without your explicit consent or a lawful transfer mechanism.

12 Children's Privacy

The orionplay Platform is strictly restricted to individuals aged 21 years and above, as mandated by PAGCOR. orionplay does not knowingly collect personal data from individuals under the age of 21. If orionplay becomes aware that personal data has been collected from an individual who is under 21, that account will be closed immediately and all associated data will be deleted in accordance with applicable law. If you believe a minor has created an orionplay account, please contact us immediately at [email protected].

13 Changes to This Privacy Policy

orionplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, orionplay will notify registered players via email to their registered address or via a prominent notice on the Platform at least fourteen (14) days before the changes take effect. The "Last Updated" date at the top of this document will reflect the date of the most recent revision. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

14 How to Contact Us

For any questions, concerns, requests to exercise data subject rights, or to contact orionplay's Data Protection Officer, please reach out using the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through the orionplay Platform

orionplay aims to acknowledge all data privacy enquiries within two (2) business days and to resolve them within thirty (30) calendar days. For complaints that are not resolved to your satisfaction, you may escalate directly to the National Privacy Commission of the Philippines.