color777 Privacy Policy

This Privacy Policy ("Policy") describes how color777 ("color777", "we", "us", or "our") collects, uses, discloses, retains, and protects personal information obtained from individuals ("you", "your", or "Data Subject") who access and use the color777 online gaming platform accessible at color777.one (the "Platform").

color777 is operated for players residing in the Philippines and is committed to protecting the privacy and personal data of all users in accordance with the Republic Act No. 10173, known as the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission ("NPC").

This Policy applies to all personal data collected through the Platform, including during registration, account management, gameplay, financial transactions, customer support interactions, and your general use of color777.one. It should be read in conjunction with color777's Terms & Conditions and Responsible Gaming Policy.

For the purposes of the Philippine Data Privacy Act of 2012, color777 acts as the Personal Information Controller ("PIC") in respect of the personal data of its registered players and website visitors.

color777 has designated a Data Privacy Officer ("DPO") responsible for overseeing the Platform's compliance with the DPA and this Policy. Players may contact the DPO for privacy-related matters through the contact details provided in Section 16 of this Policy.

Where color777 engages third-party service providers — such as payment processors, KYC verification providers, and game software companies — to process personal data on our behalf, those parties act as Personal Information Processors ("PIPs") under contracts that require them to maintain appropriate data protection standards consistent with this Policy and the DPA.

color777 collects the following categories of personal data about registered players and, in some cases, website visitors:

color777 does not intentionally collect sensitive personal information as defined under the DPA (including racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation) unless strictly required for regulatory compliance purposes and with appropriate legal basis.

color777 collects personal data through the following channels and methods:

• Direct Collection — Registration: When you create a color777 account, you directly provide identity and contact information including your name, date of birth, and Philippine mobile number.
• Direct Collection — KYC: When completing identity verification for account approval or withdrawal processing, you provide government-issued identification documents and, where required, proof of payment method ownership.
• Direct Collection — Financial Transactions: Payment method details are collected when you initiate deposits or withdrawals. color777 does not store full GCash wallet credentials; payment transactions are processed through secured payment gateway integrations.
• Direct Collection — Customer Support: Communications data is collected when you contact color777 customer support via live chat or email.
• Automated Collection — Platform Usage: Technical data including IP addresses, device identifiers, and session data is collected automatically through server logs, session cookies, and similar technologies when you access the Platform. See Section 10 for full cookie information.
• Automated Collection — Gameplay: Gaming activity data is generated automatically as a record of your betting and game interaction on the Platform. This data is required for account integrity, dispute resolution, and regulatory compliance.
• Third-Party Sources: color777 may receive personal data about you from third-party identity verification services, fraud detection providers, or payment processors in connection with KYC and anti-money laundering checks, as permitted under the DPA.

color777 uses the personal data it collects for the following specific and legitimate purposes:

• Account Registration and Management: Creating and maintaining your player account, verifying your identity and eligibility, and administering your account settings and preferences.
• Service Delivery: Providing access to all games and features on the color777 Platform, including processing deposits, executing bets, crediting winnings, and processing withdrawal requests.
• Payment Processing: Facilitating deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and other supported Philippine payment methods.
• KYC and Identity Verification: Confirming the identity of players for age verification, fraud prevention, and compliance with PAGCOR regulatory requirements and the Philippine Anti-Money Laundering Act.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, collusion, bonus abuse, and other prohibited conduct as described in color777's Terms & Conditions.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential problem gambling indicators, administering player-requested responsible gaming tools (deposit limits, self-exclusion, etc.), and complying with PAGCOR's responsible gaming requirements.
• Customer Support: Responding to player inquiries, resolving disputes, processing complaints, and providing account assistance through live chat and email support channels.
• Regulatory Compliance: Fulfilling reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine regulatory authorities.
• Platform Improvement: Analyzing aggregated and anonymized usage data to improve Platform performance, game selection, payment flows, and user experience — without identifying individual players in this analysis.
• Marketing Communications: Sending promotional offers, bonus notifications, and news about color777 features to players who have provided consent. You may opt out at any time as described in Section 11.

Under the Philippine Data Privacy Act, color777 processes personal data on the following legal bases:

• Consent (Section 12(a), DPA): Where you have given express, informed, and freely given consent for specific processing activities — in particular, for receiving marketing communications and for optional data collection beyond what is strictly necessary for account operation.
• Performance of Contract (Section 12(b), DPA): Processing that is necessary to fulfill color777's obligations under the Terms & Conditions you agreed to at registration — including creating your account, processing payments, executing bets, and delivering winnings.
• Compliance with Legal Obligation (Section 12(c), DPA): Processing required to comply with color777's obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act itself.
• Legitimate Interests (Section 12(f), DPA): Processing necessary for color777's legitimate interests — including fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your privacy rights and interests.

Where color777 processes personal data based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal. Withdrawal of consent for processing necessary to perform the contract may result in account closure.

color777 does not sell, rent, or trade personal player data. We share personal data only in the following circumstances and with the following categories of recipients:

• Payment Service Providers: GCash (G-Xchange, Inc.), PayMaya Philippines, BPI, BDO, Metrobank, and other payment processors used to facilitate deposits and withdrawals. These providers receive only the data necessary to process your specific transaction and are bound by their own privacy obligations under Philippine law.
• KYC and Identity Verification Providers: Third-party identity verification services that assist color777 in confirming player eligibility, age verification, and document authentication as required by PAGCOR and AML regulations.
• Game Software Providers: Game developers including JILI, Pragmatic Play, PG Soft, and similar studios may receive limited technical identifiers (such as anonymized player session IDs) necessary for game delivery and dispute resolution. Game providers do not receive your name, mobile number, or financial details.
• Regulatory and Law Enforcement Authorities: color777 is required by Philippine law to disclose certain player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement authorities when required by a valid legal mandate or regulatory instruction.
• Professional Advisers: Legal counsel, auditors, and compliance advisers who are bound by professional confidentiality obligations and who access data only as necessary to provide their services to color777.
• Business Transfers: In the event of a merger, acquisition, or sale of color777 or its assets, personal data may be transferred to the acquiring entity — subject to the incoming entity agreeing to maintain data protection standards at least as protective as this Policy.

color777 retains personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with applicable Philippine legal and regulatory requirements. Specific retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with color777's data destruction procedures. Anonymized data — from which all identifying elements have been permanently removed — may be retained for statistical, research, and platform improvement purposes without time limitation, as it no longer constitutes personal data under the DPA.

color777 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and color777's servers is encrypted using 256-bit Transport Layer Security (TLS) — the current industry standard for securing online financial transactions in the Philippines and globally.
• Encryption at Rest: Sensitive personal data stored in color777's databases — including identity documents and financial account references — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Internal access controls, role-based permissions, and multi-factor authentication are applied to all staff and system accounts with access to personal player data.
• Intrusion Detection and Monitoring: color777's technical infrastructure is monitored continuously for unauthorized access attempts, unusual activity patterns, and potential security incidents.
• Regular Security Audits: color777 conducts periodic security assessments and penetration testing of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All color777 personnel with access to personal data receive data privacy and security training commensurate with their role and the data they handle.
• Incident Response: color777 maintains a data breach response procedure aligned with the NPC's Circular on Security Incident Management, including notification obligations to affected players and the NPC where a breach poses risk of serious harm.

color777 uses cookies and similar tracking technologies on the Platform to deliver a functional, secure, and personalized experience. The following types of cookies and technologies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function and cannot be switched off in our systems. They include session authentication cookies that keep you logged in, security cookies that protect against cross-site request forgery, and preference cookies that remember your language and display settings. No consent is required for strictly necessary cookies under the DPA.
• Analytics Cookies: color777 uses aggregated analytics data — including session durations, page navigation paths, and device types — to understand how players use the Platform and to identify areas for improvement. This analytics data is processed in anonymized or pseudonymized form. Analytics cookies require consent.
• Functional Cookies: These cookies enable enhanced functionality such as remembering your trusted device status (which reduces the frequency of OTP verification prompts on trusted devices), your last visited game category, and other UI preferences.
• Security and Fraud Prevention Technologies: Device fingerprinting and similar techniques are used to identify unusual login patterns, detect account sharing, and prevent fraudulent activity. This processing is based on color777's legitimate interests in platform security.

Cookie Management: Your browser settings allow you to block or delete cookies. Blocking strictly necessary cookies will prevent you from using core Platform functions including logging in. Analytics and functional cookies may be blocked without affecting basic Platform functionality. Detailed cookie settings are accessible through the cookie consent banner displayed on your first visit to color777.one.

color777 does not use third-party advertising cookies or allow external advertising networks to place tracking technologies on the Platform.

As a data subject under the Philippine Data Privacy Act, you hold the following rights in relation to your personal data held by color777. To exercise any of these rights, contact color777's Data Privacy Officer as described in Section 16.

• Right to Access (Section 16(c), DPA): You may request a copy of all personal data color777 holds about you, together with information about how it is processed. Requests are fulfilled within 15 business days of identity verification.
• Right to Correction (Section 16(d), DPA): You may request correction of inaccurate, incomplete, or outdated personal data. Corrections to identity data may require supporting documentation.
• Right to Erasure (Section 16(f), DPA): You may request deletion of personal data that is no longer necessary for the purpose it was collected, or where processing was unlawful. This right is subject to color777's legal retention obligations described in Section 8.
• Right to Object (Section 16(h), DPA): You may object to the processing of your personal data based on legitimate interests or for direct marketing purposes. Objection to marketing processing is always honored; objection to processing necessary for contract performance may result in account closure.
• Right to Block (Section 16(e), DPA): You may request that processing of your personal data be suspended pending resolution of a rectification or objection request.
• Right to Data Portability: You may request a copy of the personal data you provided to color777 in a structured, commonly used, and machine-readable format.
• Right to Damages (Section 16(g), DPA): You may seek compensation for damages suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.
• Right to Lodge a Complaint: If you believe color777 has breached your data privacy rights, you may lodge a complaint directly with the National Privacy Commission of the Philippines. color777 cooperates fully with all NPC inquiries.

color777 will not discriminate against you for exercising your data privacy rights. Exercising your rights does not result in any disadvantage to your account or access to Platform services, except where the nature of the right exercised (such as erasure of essential account data) necessitates account closure.

color777 is strictly an adults-only platform. The minimum age for registration and use of the color777 Platform is 21 years, consistent with the minimum legal age for casino-style gambling under applicable Philippine law and PAGCOR regulations.

color777 does not knowingly collect personal data from individuals under the age of 21. Registration requires date of birth confirmation, and KYC processes verify age against government-issued identification documents. Age falsification is prohibited under color777's Terms & Conditions.

The color777 Platform integrates third-party services including game software platforms, payment gateways, and identity verification services. Each of these third-party providers operates under its own privacy policy and data processing terms.

color777 enters into Data Processing Agreements ("DPAs") with all third-party processors of player personal data — requiring them to implement appropriate technical and organizational security measures, process data only on color777's instructions, and not use player data for their own commercial purposes beyond the contracted service.

The color777 Platform does not contain links to external websites or third-party platforms beyond the integrated service components described above. All navigation within color777.one remains within the color777 domain. color777 is not responsible for the privacy practices of any external websites that a player may independently navigate to outside the Platform.

Key third-party service categories used by color777 and the basis for data sharing include:

• Payment Gateways (GCash, PayMaya, BPI, BDO, Metrobank): Transaction processing data shared under payment service contracts and Philippine payment system regulations.
• KYC Verification Providers: Identity document data shared under data processing agreements, solely for account verification purposes.
• Game Software Providers (JILI, Pragmatic Play, PG Soft, etc.): Anonymized session identifiers shared for game delivery and integrity purposes only. No personally identifiable data is shared with game providers.
• Platform Security Providers: Technical data (IP addresses, device fingerprints) processed for fraud detection under data processing agreements.

color777 operates primarily within the Philippines, and the majority of player personal data is stored and processed on servers located within the country or in jurisdictions with data protection standards recognized as adequate under the DPA.

Where personal data is transferred to or processed in countries outside the Philippines — for example, by game software providers or global payment infrastructure providers with servers in other jurisdictions — color777 ensures such transfers are covered by one or more of the following safeguards:

• A contractual arrangement incorporating the NPC's standard data protection clauses for cross-border data transfers.
• The recipient country having data protection laws recognized as providing a comparable level of protection to the Philippine DPA.
• Binding corporate rules or other legally recognized transfer mechanisms providing equivalent protection.

Players may request information about the specific safeguards applicable to cross-border transfers of their personal data by contacting color777's Data Privacy Officer as described in Section 16.

color777 reserves the right to update or amend this Privacy Policy at any time. When material changes are made to the Policy — changes that affect your rights or how your personal data is used in a significant way — color777 will notify registered players via their registered mobile number or email address (where held) and display a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this Policy. The current version is always accessible at color777.one/privacy-policy. We recommend reviewing this Policy periodically to stay informed of how color777 protects and uses your information.

Your continued use of the color777 Platform after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated terms. Where a material change requires fresh consent under the DPA, color777 will obtain that consent before the change takes effect for your account.

For any question, request, or concern relating to this Privacy Policy or the processing of your personal data by color777, please contact our Data Privacy Officer through the following channels:

• Live Chat: Available 24/7 within your color777 account dashboard. Identify your inquiry as a "Privacy / Data Request" for routing to the Data Privacy Officer team.
• Privacy Email: [email protected] — (plain text address, not a clickable link) — with the subject line "Privacy Request" or "Data Subject Rights Request."

color777 will acknowledge all privacy requests within 3 business days and will complete the request or provide a substantive response within 15 business days, as required under the DPA. Where additional time is needed for complex requests, color777 will notify you and provide a revised timeline.

If you are not satisfied with color777's response to a privacy complaint, you have the right to escalate your complaint directly to the National Privacy Commission of the Philippines. The NPC administers the complaints and investigation process under the DPA and provides a public complaints portal for data subjects whose rights have been violated.