209 pub Privacy Policy

1Introduction

209 pub is an online gaming and sports betting platform serving registered adult players in the Philippines. Operating a gaming platform requires 209 pub to collect and process certain personal data — to verify your identity, process financial transactions, comply with regulatory obligations imposed by PAGCOR and Philippine law, and provide the level of service Filipino players expect from a premium online casino.

209 pub takes data privacy seriously. We collect only the personal data necessary for the purposes described in this Policy. We do not sell personal data to third parties. We do not share personal data with third parties except as specifically described in Section 7 below. We apply technical and organisational security measures proportionate to the sensitivity of the data we hold.

This Policy should be read together with the 209 pub Terms & Conditions (/terms-conditions) and the Responsible Gaming Policy (/responsible-gaming), both of which contain additional information relevant to how we operate the Platform and our obligations to Players.

2Data Controller

For the purposes of the Data Privacy Act of 2012 and its implementing rules, 209 pub (operating at 209pub.app) is the Data Controller responsible for personal data collected through the Platform. As Data Controller, 209 pub determines the purposes and means of processing your personal data, and is accountable for compliance with applicable Philippine data protection law.

All data privacy enquiries, access requests, correction requests, and complaints should be directed to the 209 pub Data Privacy Officer. Contact details are set out in Section 15 of this Policy.

3Personal Data We Collect

The categories of personal data 209 pub collects are described in the table below. Not all categories apply to all players — the data collected depends on your interaction with the Platform and the services you use.

4How We Collect Your Data

4.1 Data You Provide Directly

The majority of personal data 209 pub holds about you is provided directly by you during account registration, the KYC process, support interactions, or when you update your account profile. You are responsible for ensuring that all data you provide to 209 pub is accurate, current, and complete.

4.2 Data Generated Through Platform Use

When you use the 209 pub Platform — logging in, placing bets, navigating game lobbies, processing deposits through GCash or Maya — technical and activity data is generated automatically. This data is collected through server logs, session management systems, and the standard operation of the Platform's gaming and payment infrastructure.

4.3 Data from Third Parties

Where you register or authenticate using a third-party service (such as a social login option), 209 pub may receive certain profile data from that service consistent with your privacy settings on that platform. 209 pub may also receive identity verification data from accredited KYC service providers used to confirm the authenticity of documents you submit.

5Legal Basis for Processing

Under the Data Privacy Act of 2012, 209 pub processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to create and maintain your account, process transactions, and deliver the services you have registered for.
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160, as amended), the Data Privacy Act, and other applicable Philippine laws and regulations.
• Legitimate Interest: Processing for fraud prevention, security monitoring, and responsible gaming administration where these interests do not override your rights.
• Consent: Processing for direct marketing communications. You may withdraw consent for marketing at any time without affecting the lawfulness of processing carried out before withdrawal.

6How We Use Your Personal Data

209 pub uses the personal data it holds for the following purposes:

• To create, maintain, verify, and administer your 209 pub account;
• To process deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, and other supported Philippine payment channels;
• To verify your identity and age in accordance with PAGCOR requirements and the Anti-Money Laundering Act;
• To detect, investigate, and prevent fraud, cheating, money laundering, and other dishonest or prohibited activity;
• To operate responsible gaming tools including deposit limits, self-exclusion, and session alerts, and to monitor player behaviour for indicators of gambling harm;
• To provide customer support and resolve disputes or complaints;
• To send you service-related communications such as transaction confirmations, security alerts, and policy updates;
• To send marketing communications about 209 pub promotions and new features, where you have provided consent to receive such communications;
• To comply with obligations imposed by PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other relevant Philippine regulatory bodies;
• To analyse Platform usage and improve the quality, performance, and security of the 209 pub service.

209 pub will not use your personal data for purposes materially different from those listed above without providing prior notice and, where required by law, obtaining your consent.

7Sharing Your Personal Data

209 pub does not sell your personal data. We share personal data only in the following circumstances:

7.1 Payment Service Providers

To process deposits and withdrawals, 209 pub shares the minimum necessary financial and identity data with our Philippine payment partners — GCash (Mynt), Maya (PayMaya Philippines), BPI, BDO Unibank, Metrobank, and other supported channels. All payment partners are subject to their own data protection obligations under Philippine law and BSP regulations.

7.2 Identity Verification Providers

To fulfil KYC obligations, 209 pub may share identity documents and personal data with accredited identity verification service providers. These providers process data only on 209 pub's instructions and under contractual data protection safeguards.

7.3 Regulatory Authorities

209 pub is required by law to disclose certain player data to PAGCOR, the AMLC, the National Privacy Commission, or other government agencies when required by valid legal process, regulatory directive, or applicable Philippine law. 209 pub will comply with all lawful regulatory disclosure requirements.

7.4 Technical Infrastructure Partners

209 pub uses third-party cloud hosting and technical infrastructure providers to operate the Platform. These providers may process personal data in the course of providing technical services and do so exclusively under data processing agreements that prohibit independent use of the data.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial part of the 209 pub business, personal data held by 209 pub may be transferred to the acquiring entity. Players will be notified of any such transfer and of any material change in data processing practices that results from it.

8Cookies & Tracking Technologies

The 209 pub Platform uses cookies and similar session technologies to maintain your login session, remember preferences, and ensure the Platform functions correctly. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function (e.g., session authentication, wallet state). These cannot be disabled without breaking core Platform functionality.
• Performance Cookies: Collect anonymised data about how pages are used to help 209 pub improve Platform performance and stability.
• Preference Cookies: Store user preferences such as language settings and display options between sessions.

209 pub does not use third-party advertising cookies or cross-site tracking technologies. You may manage cookie settings through your browser. Disabling strictly necessary cookies will affect Platform functionality and may prevent you from logging in or using core features.

9Data Security

209 pub implements technical and organisational security measures proportionate to the nature and sensitivity of the personal data it processes. These measures include but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and the 209 pub Platform;
• Encrypted storage for sensitive personal data, including identity documents and financial records;
• Role-based access controls limiting internal access to personal data to authorised personnel with a documented need;
• Regular internal and third-party security assessments;
• Two-factor authentication for Platform administrator access;
• Incident detection and response procedures to identify, contain, and notify affected parties of data security incidents.

In the event of a personal data breach that poses a real risk of serious harm to affected Players, 209 pub will notify the National Privacy Commission within 72 hours of discovery, and will notify affected Players without undue delay as required under the Data Privacy Act.

10Data Retention

209 pub retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to meet applicable legal retention obligations:

• Account Data: Retained for the duration of your account and for a minimum of five years after account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• KYC / Identity Documents: Retained for the period specified by PAGCOR guidelines and applicable BSP/AMLC requirements, typically not less than five years from account closure.
• Transaction Records: Retained for a minimum of five years from the date of the transaction, consistent with Philippine AML obligations.
• Gaming Activity Logs: Retained for a minimum of 12 months in an immediately accessible format for dispute resolution and regulatory audit purposes, and for five years in archived form.
• Marketing Data: Retained until you withdraw consent for marketing communications, after which marketing preference data is deleted within 30 days.
• Technical Logs: Retained for a rolling period of 12 months for security and fraud prevention purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with 209 pub's data disposal procedures.

11Your Data Subject Rights

Under the Data Privacy Act of 2012 and its implementing rules, you have the following rights in respect of personal data held about you by 209 pub:

• Right to be Informed: The right to receive clear, accessible information about how your data is processed — which this Policy is intended to fulfil.
• Right of Access: The right to request a copy of the personal data 209 pub holds about you and information about how it is used.
• Right to Correction: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure / Blocking: The right to request deletion or blocking of personal data where processing is no longer lawful or necessary, subject to 209 pub's legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interest or direct marketing. Where you object to direct marketing, 209 pub will cease that processing immediately.
• Right to Data Portability: The right to receive personal data you have provided to 209 pub in a structured, commonly used, machine-readable format where technically feasible.
• Right to Damages: The right to be compensated for damage suffered as a result of inaccurate, incomplete, outdated, or unlawfully obtained personal data, subject to applicable law.

To exercise any of these rights, submit a written request to 209 pub's Data Privacy Officer at the contact details in Section 15. 209 pub will respond within 15 business days of receipt of a valid, verified request. 209 pub may need to verify your identity before processing a data rights request.

12Children and Minors

The 209 pub Platform is strictly for adults aged 21 years and above. 209 pub does not knowingly collect personal data from persons under the age of 21. If 209 pub discovers or is notified that personal data has been collected from a person under 21, that account will be immediately suspended, the data will be deleted in accordance with legal requirements, and the matter will be handled in accordance with 209 pub's underage access procedures.

Parents and guardians who believe a minor has created a 209 pub account should contact the Data Privacy Officer at the contact details in Section 15 immediately.

13Cross-Border Data Transfers

Where the use of cloud hosting or technical infrastructure providers results in personal data being processed or stored outside the Republic of the Philippines, 209 pub ensures that such transfers are made only to recipients in countries with adequate data protection standards as recognised under the Data Privacy Act, or under contractual safeguards — such as standard contractual clauses approved by the National Privacy Commission — that provide equivalent protections to those required under Philippine law.

Where personal data is transferred internationally, 209 pub remains accountable for ensuring that the receiving party processes the data in accordance with this Policy and applicable Philippine data protection requirements.

14Changes to This Privacy Policy

209 pub may update this Privacy Policy from time to time to reflect changes in our data processing practices, Platform services, or applicable legal requirements. Material changes will be communicated to registered Players by email to the address on file, with a minimum of 14 days' notice before the amended Policy takes effect. The effective date at the top of this page will be updated to reflect the date the most recent version became effective.

Continued use of the 209 pub Platform after the effective date of any material amendment to this Policy constitutes your acceptance of the revised terms. If you do not accept a material amendment, you may close your account before the effective date and request withdrawal of your eligible balance.

15Contact & Complaints

For questions about this Privacy Policy, to exercise your data subject rights, or to raise a data privacy concern, please contact the 209 pub Data Privacy Officer:

• Email: [email protected]
• Subject Line: "Data Privacy Request" or "Privacy Complaint"
• Response Time: Within 15 business days of receiving a verified request

If you are not satisfied with 209 pub's response to a data privacy complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about the NPC complaints process is available through official Philippine government channels.