me903 Privacy Policy

1 About This Policy

1.1 This Privacy Policy is issued by the legal entity operating the me903 online casino and sports betting platform at https://me903.org (referred to throughout this document as "me903," "the Company," "we," "us," or "our").

1.2 This Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data relating to: (a) registered players and account holders on the me903 platform; (b) visitors to the me903 website who have not completed registration; and (c) individuals who contact me903 support or communicate with us through any channel.

1.3 me903 acts as a Personal Information Controller as defined under the Data Privacy Act of 2012 (Republic Act No. 10173) in respect of the personal data it processes. In certain situations, me903 may act as a Personal Information Processor where it processes personal data on behalf of another controller.

1.4 This Policy applies to all personal data processed through the me903 website, mobile-optimised web application, customer support channels, and any other service operated under the me903 brand. It does not apply to third-party websites or services that may be linked from the me903 platform.

1.5 Capitalised terms used in this Policy that are not otherwise defined herein carry the same meaning as in the me903 Terms and Conditions.

2 Personal Data We Collect

2.1 me903 collects the following categories of personal data, depending on how you interact with the platform:

2.1.1 Identity & Registration Data

2.1.2 Contact Data

2.1.3 Financial & Transaction Data

2.1.4 Technical & Usage Data

When you access me903, we automatically collect certain technical information, including: IP address, device type and model, operating system, browser type and version, screen resolution, referring URL, pages visited on me903, session duration and timestamps, and connection type (mobile data or WiFi). This data is collected through cookies and server log files as described in Section 10.

3 How We Collect Your Personal Data

me903 collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact support, or update your account settings;
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you access the me903 website or web application, as detailed in Section 10;
• From payment processors — transaction confirmation data and payment status information received from GCash, Maya, BPI, BDO, Metrobank, and other Philippine payment service providers when you initiate a transaction;
• From identity verification services — during the KYC process, me903 may use third-party identity verification providers who cross-check submitted documents against authoritative data sources;
• From fraud prevention services — device fingerprinting and behavioural analytics data collected to detect and prevent fraud, bonus abuse, and multi-accounting;
• From regulatory authorities — in certain circumstances, PAGCOR and other Philippine government agencies may provide or request information in connection with their regulatory and enforcement functions.

4 Purposes of Processing

4.1 me903 processes personal data for the following specific, legitimate purposes:

1. Account Registration and Management: Creating and maintaining your me903 account, authenticating your identity at login, managing account settings, and handling account closure requests;
2. Age Verification and KYC Compliance: Verifying that you are 21 years of age or older as required by PAGCOR regulations, confirming your identity, and ensuring compliance with anti-money laundering (AML) obligations under the Philippine AMLA;
3. Payment Processing: Processing deposits to and withdrawals from your me903 account balance, verifying payment method ownership, and reconciling transaction records;
4. Game Provision and Betting Services: Operating the casino, sports betting, and specialty game services, maintaining bet records, calculating and paying out winnings, and resolving game-related disputes;
5. Customer Support: Responding to support enquiries, resolving complaints, and providing assistance through email, live chat, and other communication channels;
6. Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, bonus abuse, money laundering, account takeover, and other security threats;
7. Responsible Gaming: Monitoring gameplay patterns to identify indicators of problem gambling, administering self-exclusion and deposit limit tools, and complying with responsible gaming obligations under PAGCOR's framework;
8. Regulatory Compliance and Reporting: Meeting reporting, record-keeping, and data-sharing obligations under PAGCOR's licensing conditions, the AMLA, and other applicable Philippine laws;
9. Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have provided explicit prior consent, as described in Section 13;
10. Platform Improvement: Analysing anonymised or pseudonymised usage data to improve the me903 website, game lobby, payment flows, and customer experience.

5 Legal Bases for Processing

5.1 Under the Data Privacy Act of 2012, me903 relies on the following legal bases for processing personal data:

• Performance of a Contract: Processing necessary to provide the services you have contracted for by creating a me903 account — including account management, payment processing, and game provision;
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Philippine AMLA, the Data Privacy Act itself, and other applicable laws — including KYC verification and AML transaction monitoring;
• Legitimate Interests: Processing for fraud prevention, security monitoring, and platform improvement, where our legitimate interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications and non-essential cookies, where you have provided freely given, specific, informed, and unambiguous prior consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Disclosure of Your Personal Data

6.1 me903 does not sell, rent, or trade your personal data. We share your personal data only in the following circumstances and with the following categories of recipients:

• Payment Service Providers: GCash (Mynt), Maya Philippines, BPI, BDO, Metrobank, and other payment processors receive the minimum data necessary to process your transactions — typically your account reference, transaction amount, and payment method identifier;
• KYC and Identity Verification Providers: Third-party identity verification services that assist me903 in verifying player identity and age during the KYC process, bound by data processing agreements;
• Fraud Prevention and Security Providers: Specialist services that assist in detecting fraud, multi-accounting, and abuse patterns, operating under contractual data protection obligations;
• Game Content Providers: Third-party game suppliers whose games are available on the me903 platform may receive anonymised or pseudonymised session data for technical support and game certification purposes;
• PAGCOR and Philippine Regulatory Authorities: As required by the Company's PAGCOR license and applicable Philippine law, including AML reporting obligations to the Anti-Money Laundering Council (AMLC) for covered and suspicious transactions;
• Law Enforcement and Government Authorities: Where required or permitted by Philippine law, in response to valid legal process, or to protect the safety, rights, or property of me903 or third parties;
• Professional Advisors: Legal counsel, auditors, and accountants, subject to professional confidentiality obligations, where access to your data is strictly necessary for the provision of their services.

6.2 Any third party to whom me903 discloses personal data is required to process that data only for the specific purpose of the disclosure, in accordance with applicable data protection law, and subject to contractual data protection obligations.

7 Data Retention

7.1 me903 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active Account Data: Retained for the duration of your active me903 account relationship, plus the post-closure retention period below;
• Post-Account-Closure Retention: Following account closure, me903 retains account and transaction records for a minimum of five (5) years to comply with PAGCOR record-keeping obligations, AMLA requirements, and applicable Philippine tax laws;
• KYC Documentation: Retained for a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and the Philippine AMLA;
• Support Correspondence: Retained for three (3) years following resolution of the relevant support interaction, to facilitate future enquiries and dispute resolution;
• Technical and Usage Logs: Retained for up to twelve (12) months, after which they are anonymised or deleted;
• Marketing Consent Records: Retained for as long as necessary to demonstrate compliance with consent obligations, and in any event for the duration of any marketing communications sent.

7.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be attributed to you as an individual.

8 Your Privacy Rights

8.1 me903 will respond to all substantiated privacy rights requests within thirty (30) calendar days of receipt, in accordance with the Data Privacy Act and NPC implementing regulations. Complex requests may take longer; you will be informed of the extended timeframe.

8.2 Some rights are subject to limitations. For example, the right to erasure cannot be exercised where me903 is required to retain your data under PAGCOR licensing conditions, the AMLA, or other applicable Philippine law.

9 Data Security

9.1 me903 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and me903 servers;
• Encryption of sensitive data at rest, including KYC documents and payment details;
• Role-based access controls ensuring that employees and contractors can only access personal data that is necessary for their specific function;
• Regular security assessments and vulnerability scanning of the me903 platform infrastructure;
• Multi-factor authentication requirements for administrative access to systems containing personal data;
• Employee training on data privacy obligations under the Data Privacy Act and the Company's internal data handling procedures.

9.2 Data Breach Notification. In the event of a personal data breach that is likely to result in a real risk of serious harm to affected data subjects, me903 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay, in accordance with NPC Circular No. 16-03 and the Data Privacy Act.

9.3 While me903 takes all reasonable steps to protect your personal data, no transmission over the internet and no storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own me903 login credentials and device.

10 Cookies & Tracking Technologies

10.1 me903 uses cookies and similar tracking technologies — including web beacons, pixel tags, and local storage — to operate the platform, improve performance, and deliver relevant content. Cookies are small text files stored on your device when you visit the me903 website.

Categories of Cookies Used by me903

10.2 You can control cookie settings through your browser's privacy or settings menu. Disabling strictly necessary cookies will impair the functionality of the me903 platform and may prevent login. For mobile users accessing me903 through Chrome on Android or Safari on iOS, refer to your browser's help documentation for cookie management options.

11 Children's Privacy

11.1 If you believe that a minor has accessed the me903 platform or that me903 has inadvertently collected personal data from a person under 21, please notify our Data Protection Officer immediately using the contact details in Section 15.

11.2 The Company may share information about suspected underage access with PAGCOR as required under its licensing obligations.

12 Cross-Border Data Transfers

12.1 The me903 platform primarily processes and stores personal data within the Republic of the Philippines. However, certain third-party service providers — including game content suppliers, cloud infrastructure providers, and identity verification services — may be located or operate servers in countries outside the Philippines.

12.2 Where personal data is transferred to a country outside the Philippines, me903 ensures that such transfers are protected by appropriate safeguards in accordance with Section 21 of the Data Privacy Act, which may include: contractual clauses binding the recipient to data protection standards equivalent to those applicable in the Philippines; or transfers to countries that the National Privacy Commission has assessed as providing an adequate level of data protection.

12.3 me903 does not transfer your personal data to third parties located outside the Philippines for their own independent marketing or commercial purposes.

13 Marketing Communications

13.1 me903 will send you promotional emails, SMS messages, or platform notifications about bonuses, new games, sports betting offers, and other me903 promotions only where you have provided prior, explicit, and freely given consent during registration or through your account settings.

13.2 Withdrawing Consent. You may withdraw your consent to receive marketing communications at any time by: (a) clicking the "unsubscribe" link in any marketing email; (b) replying "STOP" to any marketing SMS; or (c) updating your communication preferences in your me903 account settings. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

13.3 Even where you have opted out of marketing communications, me903 will continue to send you transactional and service-related messages that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts. These messages are not marketing communications and cannot be opted out of while your account remains active.

14 Updates to This Privacy Policy

14.1 me903 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or the services we offer. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

14.2 Material changes to this Policy — for example, changes to the purposes for which we process your data or the categories of data we collect — will be communicated to registered players via the email address associated with their account, with reasonable prior notice before the changes take effect.

14.3 Continued use of the me903 platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with the updated Policy, you should cease using the platform and may request account closure in accordance with the Terms and Conditions.

14.4 Previous versions of this Privacy Policy are available on request from the Data Protection Officer.

15 Contact & Data Protection Officer

15.1 me903 has appointed a Data Protection Officer (DPO) responsible for overseeing the Company's compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO is the point of contact for all data privacy enquiries, rights requests, and complaints.