Legal
Privacy Policy
This Policy explains what personal data MegaAraw collects, why and on what legal basis, who we share it with, where it is processed, how long we keep it and how you can exercise your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).
Last updated: 20 October 2026
1. Who is responsible
XN Solutions Inc., operating MegaAraw, is the personal information controller for data collected through megaaaraw.com. Registered address: Spaces Utrecht, Lange Viestraat 2b, 3511 BK Utrecht, Netherlands. Because MegaAraw serves players in the Philippines, the Data Privacy Act applies to our processing of your data wherever it takes place. Our Data Protection Officer can be reached at privacy@megaaaraw.com.
2. Data we collect
- Registration: mobile number, your eligibility confirmations and one-time password records.
- Identity verification (KYC): full name, date of birth, address, email, government ID type, number and image, and a selfie for face verification.
- Account activity: balance, deposits, withdrawals, game rounds, limits and exclusion status.
- Support: messages you send us, complaints and our replies.
- Technical: IP address, device and browser type, security logs and the cookies described in the Cookie Policy.
3. Why we use it and legal bases
We process personal information only where one of the lawful criteria in Section 12 of RA 10173 applies, and sensitive personal information only under Section 13. The table shows which basis we rely on for each purpose.
| Purpose | Data used | Legal basis (RA 10173) |
|---|---|---|
| Creating your account and confirming it is you who logs in | Mobile number, OTP records | Performance of our contract with you, or steps you asked us to take before entering it — Sec. 12(b) |
| Running your wallet, processing payments and recording game history | Account activity, payment details, game rounds | Performance of contract — Sec. 12(b); record-keeping required by law — Sec. 12(c) |
| Verifying age, identity and eligibility, including NDRP and exclusion checks (KYC) | Name, date of birth, address, government ID | Compliance with a legal obligation under PAGCOR rules and the Anti-Money Laundering Act (RA 9160, as amended) — Sec. 12(c); for sensitive data, processing provided for by existing laws and regulations — Sec. 13(b) |
| Face verification | Selfie compared with your ID photo | Your consent, given at the verification step — Sec. 13(a); regulatory identity checks — Sec. 13(b) |
| Anti-money-laundering monitoring and reports to authorities | Identity, transactions, game activity | Legal obligation — Sec. 12(c) and Sec. 13(b) |
| Responsible gaming tools, limits and exclusions | Account activity, limits, exclusion status | Legal obligation under PAGCOR rules — Sec. 12(c); performance of contract — Sec. 12(b) |
| Preventing fraud and keeping the website secure | Technical data, security logs, account activity | Our legitimate interest in protecting players and the platform, balanced against your rights — Sec. 12(f) |
| Answering messages, complaints and disputes | Contact details, messages, related records | Performance of contract — Sec. 12(b); legitimate interest — Sec. 12(f); establishing or defending legal claims — Sec. 13(f) |
Where we rely on consent, you can withdraw it at any time by writing to privacy@megaaaraw.com. Withdrawal does not affect processing already done; if you withdraw consent to face verification before KYC is finished, we cannot complete your verification. We do not send marketing messages, we do not sell your personal data and we do not use it for automated decisions with legal effect without human review.
4. Sensitive personal information
Under Section 3(l) of RA 10173, part of the data needed for a regulated gaming account is sensitive personal information:
- Age and date of birth — needed to confirm you are 21 or older.
- Government-issued identifiers — the number and image of your PhilSys ID, passport, driver’s license, UMID, PRC ID, postal ID or voter’s ID.
- Your selfie — a facial image used only to match you with your ID. We treat it with the same protection as sensitive data.
- Health information you choose to share — for example, if you tell support about a gambling problem when asking for a limit or exclusion.
We process this data only for the purposes listed above, on the bases of Section 13(a), (b) and (f). Access is limited to the verification, compliance and support staff who need it; documents are stored encrypted and are never used for marketing or shared with game providers. Health information you share is used only to apply the protection you asked for.
5. Who we share it with
- identity-verification, SMS and payment service providers acting on our instructions under written agreements;
- game providers, only as needed to run the games you play — they receive a player ID, your session, bets and results, currency and IP address, not your name or ID documents;
- PAGCOR, the Anti-Money Laundering Council and other authorities when the law requires it;
- professional advisers and auditors bound by confidentiality, when needed for a legal claim or audit.
6. Transfers outside the Philippines
Some of the companies involved in running MegaAraw are located outside the Philippines, so your data may be processed abroad:
- Our company: XN Solutions Inc. is registered in the Netherlands, and authorised staff may access account and compliance data from the European Union.
- Game providers: games from international studios — for example Evolution, NetEnt, Red Tiger, IGT, Light & Wonder, AGS and Everi — run on the providers’ servers, which may be outside the Philippines. They receive the game data described in section 5.
- Verification, SMS and payment providers may store or process data in other countries, depending on the provider connected to the platform.
Under the accountability principle in Section 21 of RA 10173, we remain responsible for your data after it is transferred. Each recipient must sign an agreement that limits use to our instructions and requires protection comparable to the Data Privacy Act. We send only the minimum data each recipient needs, always over encrypted connections. You can ask us for the current list of recipients and countries at privacy@megaaaraw.com.
7. How long we keep it
We keep each type of data only as long as its purpose requires, and then delete or anonymise it. Where the law sets a minimum period, we follow it.
| Data | Retention period | Why |
|---|---|---|
| Registration applications that did not become an account | 6 months from the application | Time to contact you and finish sign-up |
| OTP records | 90 days | Resolving log-in problems and investigating misuse |
| KYC data and ID documents | While the account is open and 5 years after it is closed | Customer-identification records under the Anti-Money Laundering Act |
| Deposits, withdrawals and other financial transactions | 5 years from the date of each transaction | Transaction records under the Anti-Money Laundering Act and PAGCOR rules |
| Game history (rounds, stakes, results) | 5 years from the date of the round | Regulatory audits and settling disputes about rounds |
| Limits, time-outs and exclusion records | For the duration of the limit or exclusion and 5 years after it ends | Enforcing the exclusion and showing that it was applied |
| Support messages and complaints | 3 years after the case is closed | Follow-up questions, repeat complaints and legal claims |
| Technical and security logs | 12 months | Security and fraud prevention |
| Cookies | As listed in the Cookie Policy | Log-in, form security, 21+ confirmation |
A period can be extended only while the data is needed for an open investigation, a dispute or a legal claim, or when an authority orders us to keep it. Once that ends, the normal period applies.
8. Security
We use encrypted connections, access controls and OTP-based log-in to protect your data. No system is perfectly secure; tell us at once if you suspect misuse of your account. If a personal data breach puts you at real risk of serious harm, we notify you and the National Privacy Commission as the law requires.
9. Your rights
Under the Data Privacy Act you have the right to be informed, to access, to object, to correct, to erasure or blocking where applicable, to data portability, and to claim damages. You may also file a complaint with the National Privacy Commission. Some rights are limited where we must keep data by law — for example, we cannot erase KYC records before the anti-money-laundering period ends.
10. Contact
Send privacy requests to privacy@megaaaraw.com or through the contact form. We may need to confirm your identity before acting on a request.