twinkaboo Privacy Policy

This Privacy Policy ("Policy") explains how twinkaboo ("twinkaboo," "we," "us," "our"), as Personal Information Controller, collects, uses, stores, shares, and protects personal data in connection with your access to and use of the twinkaboo online gaming platform at https://twinkaboo.app ("Platform"). This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations. By registering an account or using the Platform, you acknowledge that you have read, understood, and consent to the data practices described herein.

1. Introduction & Controller Identity

1.1 twinkaboo is the Personal Information Controller for all personal data processed through the Platform. As controller, twinkaboo determines the purposes and means of personal data processing and is responsible for ensuring that processing complies with applicable Philippine data privacy law.

1.2 This Policy applies to all players, visitors, and registered account holders who interact with the Platform, regardless of whether they are browsing without an account or are fully registered and active players.

1.3 If you have questions about this Policy or wish to exercise your data privacy rights, contact twinkaboo's Data Protection Officer at the details provided in Section 13.

2. Personal Data We Collect

twinkaboo collects personal data through the following channels: account registration, identity verification, payment processing, gameplay, customer support interactions, and automated technical collection during Platform use. The categories of data collected include:

Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, nationality, government ID number and type	Registration form; KYC verification
Contact Data	Email address, Philippine mobile number, mailing address	Registration; account updates
Financial Data	GCash or PayMaya account number (last 4 digits only), bank account details for withdrawal, deposit and transaction history	Payment processing; cashier
Gameplay Data	Game history, wager amounts, session duration, RTP outcomes, bonus utilisation	Automated — Platform systems
Technical Data	IP address, device type and OS, browser type and version, session timestamps	Automated — server logs; cookies
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions
Responsible Gaming Data	Self-imposed deposit limits, cool-off period elections, self-exclusion requests	Account settings; support requests

twinkaboo does not collect sensitive personal information such as health records, religious affiliation, or political opinion unless legally required to do so. twinkaboo does not knowingly collect personal data from persons under the age of 21.

3. How We Use Your Personal Data

3.1 Account Management. To create, maintain, verify, and administer your twinkaboo Account, including processing deposits and withdrawals, tracking your balance, and providing access to games.

3.2 Identity Verification & KYC. To verify your identity, age, and eligibility to participate in real-money gaming on the Platform, as required by anti-money laundering regulations and responsible gaming obligations.

3.3 Payment Processing. To process deposits, withdrawals, and refunds via your selected Philippine payment method (GCash, PayMaya, BPI, BDO, Metrobank). twinkaboo does not store full payment credentials; transaction processing is handled by certified payment service providers.

3.4 Regulatory Compliance. To comply with applicable Philippine laws and regulations, including anti-money laundering (AML) obligations, responsible gaming requirements, and any lawful requests from regulatory or law enforcement authorities.

3.5 Fraud Prevention & Security. To detect, investigate, and prevent fraudulent transactions, unauthorised account access, cheating, collusion, and other prohibited conduct on the Platform.

3.6 Responsible Gaming. To monitor gameplay patterns for indicators of problem gambling behaviour, administer responsible gaming tools (deposit limits, self-exclusion), and communicate with players who may need support — in accordance with twinkaboo's player protection obligations.

3.7 Customer Support. To respond to your enquiries, investigate complaints, and resolve disputes through twinkaboo's 24/7 support channels.

3.8 Marketing Communications. With your consent, to send you promotional offers, new game announcements, and other marketing communications by email or SMS. You may withdraw this consent at any time.

3.9 Platform Improvement. To analyse aggregated, anonymised gameplay and usage data to improve Platform performance, game selection, and user experience. This analysis does not involve profiling individual players for commercial purposes.

4. Legal Bases for Processing

twinkaboo processes personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing required to fulfil the twinkaboo account agreement — account creation, payment processing, game access, and customer support.
• Legal Obligation: Processing required for compliance with AML regulations, age verification obligations, and other applicable Philippine laws.
• Legitimate Interests: Processing for fraud prevention, Platform security, and responsible gaming monitoring — where twinkaboo's interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications and optional analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

5.1 twinkaboo does not sell, rent, or trade your personal data to third-party marketers or data brokers.

5.2 twinkaboo may share personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Service Providers: GCash (Mynt), PayMaya (Voyager), and partner banks (BPI, BDO, Metrobank) for the processing of deposits and withdrawals.
• Identity Verification Providers: Third-party KYC service providers engaged to verify government-issued Philippine identification documents.
• Game Software Providers: Licensed game providers whose software operates on the Platform. These providers may receive anonymised player session data for game integrity and technical support purposes.
• Regulatory & Law Enforcement Authorities: Where required by Philippine law, court order, or legitimate regulatory demand, twinkaboo will disclose personal data to the appropriate authority.
• IT Infrastructure Providers: Cloud hosting and data centre providers engaged by twinkaboo, bound by contractual data protection obligations and operating infrastructure located in compliant jurisdictions.

5.3 All third parties to whom twinkaboo discloses personal data are contractually required to maintain the confidentiality and security of that data and to use it only for the specified purpose.

6. Cookies & Tracking Technologies

6.1 twinkaboo uses cookies and similar tracking technologies to operate the Platform, maintain session state, prevent fraud, and improve user experience. The types of cookies used include:

• Strictly Necessary Cookies: Required for Platform function — session authentication, security tokens, load balancing. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your language preferences, game history display settings, and last-visited game categories.
• Analytics Cookies: Collect anonymised data about Platform usage (pages visited, session length, game categories accessed) to improve Platform performance. No individual player is identified in analytics reports.

6.2 You can manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect certain Platform features.

6.3 twinkaboo does not use third-party advertising or behavioural tracking cookies. No player data is shared with advertising networks.

7. Data Retention

7.1 twinkaboo retains personal data for as long as your Account is active and for a period of five (5) years following account closure, consistent with Philippine AML record-keeping obligations and the statute of limitations for potential legal claims.

7.2 Transaction records (deposits, withdrawals, wager history) are retained for a minimum of five (5) years from the date of the transaction in compliance with anti-money laundering regulations.

7.3 Marketing consent records and opt-out records are retained for three (3) years from the date of the last consent or opt-out action.

7.4 Technical logs (server access logs, IP logs) are retained for ninety (90) days and then automatically purged, except where retention is required for a specific ongoing security investigation.

7.5 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Data Security

8.1 twinkaboo implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS 1.2 or higher encryption for all data in transit between your device and the Platform
• AES-256 encryption for all personal data stored in twinkaboo's databases
• Salted bcrypt hashing for all Account passwords — never stored in recoverable plain text
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Regular security audits and penetration testing by independent security professionals
• Automated anomaly detection for unusual login patterns and transaction activity

8.2 Personal Data Breach. In the event of a personal data breach affecting Filipino players, twinkaboo will comply with the notification obligations under the Data Privacy Act — notifying the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach and notifying affected players without undue delay where the breach poses a high risk to their rights.

9. Your Privacy Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by twinkaboo:

• Right to Be Informed: The right to know that your personal data is being collected and how it is being used — addressed by this Policy.
• Right to Access: The right to request a copy of the personal data twinkaboo holds about you.
• Right to Correction: The right to request correction of inaccurate, incomplete, or outdated personal data in your Account.
• Right to Erasure: The right to request deletion of personal data where processing is no longer necessary, subject to overriding legal retention obligations.
• Right to Object: The right to object to processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests where your individual circumstances warrant it.
• Right to Data Portability: The right to receive a copy of personal data you have provided to twinkaboo in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, contact twinkaboo's Data Protection Officer as described in Section 13. Requests will be acknowledged within 5 business days and resolved within 30 calendar days, consistent with NPC guidelines.

10. Children's Privacy

twinkaboo is strictly intended for persons aged 21 years and above. twinkaboo does not knowingly collect, process, or retain personal data from persons under 21 years of age. If we become aware that personal data has been collected from an individual under 21, we will immediately delete that data and close the associated Account. If you believe a minor has accessed the Platform, please contact support immediately.

11. International Data Transfers

11.1 Where twinkaboo engages infrastructure or service providers whose processing occurs outside the Philippines, twinkaboo ensures that adequate safeguards are in place, consistent with Section 21 of the DPA and applicable NPC regulations. Safeguards include data processing agreements incorporating standard contractual clauses and requirements that overseas processors maintain security standards equivalent to those required under Philippine law.

11.2 twinkaboo will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without first obtaining your explicit consent or implementing the contractual safeguards described above.

12. Amendments to This Policy

twinkaboo reserves the right to update this Privacy Policy at any time to reflect changes in law, regulatory guidance, or Platform practices. Material changes will be communicated to registered players via the email address on file no fewer than 7 calendar days before the amended Policy takes effect. The effective date at the top of this document will be updated accordingly. Continued use of the Platform after the effective date of any amendment constitutes acceptance of the revised Policy. The current version is always available at https://twinkaboo.app/privacy-policy.

13. Contact & Data Protection Officer

For all privacy-related queries, data subject right requests, or to report a suspected privacy concern, contact twinkaboo's Data Protection Officer:

• Live Chat: Available 24/7 within the Platform — select "Privacy / Data Request" as the topic
• Email: [email protected] (subject line: "Privacy Policy Enquiry")

All privacy requests are handled in accordance with the timelines prescribed by the National Privacy Commission. If you are unsatisfied with twinkaboo's response, you have the right to lodge a complaint directly with the NPC.