Privacy Policy — kh888 Online Casino

Introduction and Scope

This Privacy Policy (hereinafter "Policy") describes how kh888 (the "Company", "Operator", "we", "us", or "our") collects, uses, processes, stores, shares, and protects the personal data of individuals (hereinafter "Data Subject", "Player", "User", or "you") who access or use the kh888 online gaming platform available at https://kh888.asia, including all associated sub-pages, game interfaces, and account management features (collectively, the "Platform").

kh888 is a Philippine-facing online casino and gaming platform operating under PAGCOR regulatory oversight, serving players across the Philippines — including Metro Manila, Cebu, Davao, Quezon City, and all other regions of the archipelago. All personal data collected through the Platform is processed in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), the issuances of the National Privacy Commission ("NPC"), and applicable PAGCOR regulatory requirements.

This Policy applies to all personal data kh888 collects through the registration process, account usage, payments, customer support interactions, website analytics, and other means described in this Policy. It does not apply to the privacy practices of third-party game providers, payment processors, or other external services linked to or integrated with the Platform, which are governed by their respective privacy policies.

By registering a kh888 Account or otherwise using the Platform, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any provision of this Policy, you must discontinue use of the Platform and may request account closure in accordance with the process described in the kh888 Terms & Conditions.

Data Controller and Data Protection Officer

2.1 Identity of the Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 and applicable data protection law, kh888 is the personal information controller responsible for your personal data collected through the Platform. kh888 determines the purposes and means by which personal data is processed.

2.2 Data Protection Officer

kh888 has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA, responding to data subject requests, liaising with the National Privacy Commission, and conducting privacy impact assessments for new data processing activities. The DPO can be contacted using the details provided in Section 15 of this Policy.

Categories of Personal Data Collected

kh888 collects the minimum personal data necessary to operate the Platform, comply with legal and regulatory obligations, and provide services to players. The categories of personal data we collect are described in the table below.

kh888 does not collect sensitive personal information as defined under the DPA (including health information, political affiliations, or biometric data) except where a government-issued ID that incidentally contains such information is submitted for KYC purposes. In such cases, only the information relevant to age and identity verification is processed.

How kh888 Collects Personal Data

kh888 collects personal data through the following means:

1. Direct Collection — Registration: When you create a kh888 Account, you provide identity and contact data directly through the registration form at kh888 Login.
2. Direct Collection — KYC Verification: When you submit KYC documents, you provide identity data including a photo of your government-issued Philippine ID.
3. Direct Collection — Payments: When you make a deposit or request a withdrawal, financial data is collected and processed through our integrated payment partners (GCash, PayMaya, BDO, BPI, Metrobank, UnionBank, and crypto processing services).
4. Direct Collection — Support Interactions: When you contact kh888 support via live chat or email, communications data is collected and retained for quality assurance and compliance purposes.
5. Automatic Collection — Platform Usage: Technical data including IP addresses, device fingerprints, and session metadata is collected automatically through server logs, session management systems, and analytics tools when you access the Platform.
6. Automatic Collection — Cookies and Tracking: kh888 uses first-party cookies and equivalent technologies to maintain sessions, remember preferences, and collect anonymized analytics. See Section 9 of this Policy for full cookie details.
7. Third-Party Sources: kh888 may receive verification data from payment processors (e.g., GCash) to confirm the ownership of a payment instrument, and may receive fraud-screening signals from third-party risk management providers to protect the integrity of the Platform.

Purposes of Processing and Lawful Basis

kh888 processes personal data only for specific, declared, and legitimate purposes. Each processing activity is grounded in one or more lawful bases under the Philippine Data Privacy Act of 2012. The table below maps each processing purpose to its corresponding lawful basis.

Data Sharing and Disclosure

6.1 Third-Party Service Providers

kh888 shares personal data with carefully selected third-party service providers who assist in operating the Platform, subject to data processing agreements that bind them to confidentiality and DPA-compliant data handling standards. These providers include:

• Payment Processors: GCash, PayMaya, BDO, BPI, Metrobank, UnionBank, and cryptocurrency processing services — to execute deposits and withdrawals;
• KYC and Identity Verification Providers: Third-party identity verification services used to process government ID submissions;
• Game Providers: Licensed game studios including Pragmatic Play, PG Soft, Jili, and others — who receive session data necessary to operate their games on the kh888 Platform;
• Cloud Hosting and Infrastructure Providers: For secure data storage and Platform operation;
• Analytics and Security Providers: For Platform performance analytics and fraud detection — using anonymized or aggregated data where possible.

6.2 Regulatory and Legal Disclosure

kh888 will disclose personal data to regulatory authorities, law enforcement agencies, or courts where required or permitted by Philippine law, including but not limited to: PAGCOR (under the PAGCOR Charter), the Anti-Money Laundering Council (AMLC) (under the Anti-Money Laundering Act, as amended), the National Privacy Commission (NPC), and any court or tribunal of competent jurisdiction. Such disclosures are made without prior notice to the Data Subject where the law prohibits such notification.

6.3 No Data Sales

kh888 does not sell, rent, lease, or otherwise transfer your personal data to any third party for that party's independent marketing or commercial purposes. Data shared with third-party partners under Section 6.1 is used exclusively for the purpose for which it was shared and under contractual obligations of confidentiality.

Data Retention

kh888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention standards apply:

• Active Accounts: Personal data is retained for the full duration of your kh888 Account and for a minimum of five (5) years following Account closure, to comply with PAGCOR record-keeping requirements and AMLA obligations.
• Financial and Transaction Records: Retained for a minimum of ten (10) years from the date of the relevant transaction, as required by the Anti-Money Laundering Act of the Philippines and applicable PAGCOR directives.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the date of the last customer transaction, whichever is later.
• Game Session Records: Retained for a minimum of three (3) years for dispute resolution purposes, and longer where required by PAGCOR.
• Support Communications: Retained for a minimum of two (2) years from the date of the communication for quality assurance and dispute resolution.
• Marketing Consent Records: Retained for the duration of the consent and for a minimum of two (2) years following withdrawal of consent, as evidence of the consent record.

Following the applicable retention period, personal data is securely deleted, anonymized, or aggregated such that it can no longer identify an individual Data Subject. Secure deletion follows industry-standard data destruction protocols.

Data Security Measures

kh888 implements a layered technical and organizational security framework to protect personal data against unauthorized access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in Transit: All data transmitted between the Player's device and kh888 servers is encrypted using TLS 1.2 or higher (256-bit AES encryption);
• Encryption at Rest: Sensitive personal data — including identity documents, financial data, and hashed passwords — is encrypted at rest on kh888's secure servers;
• Access Controls: Access to personal data is restricted on a strict need-to-know basis using role-based access controls. All kh888 staff with access to personal data are bound by confidentiality obligations;
• Multi-Factor Authentication (MFA): Administrative access to systems holding personal data requires multi-factor authentication;
• Intrusion Detection and Monitoring: kh888 operates continuous security monitoring and intrusion detection systems on all Platform infrastructure;
• Penetration Testing: kh888 conducts regular third-party penetration tests and vulnerability assessments on the Platform;
• Incident Response: kh888 maintains a documented personal data breach response plan. Where a breach affecting your data occurs, kh888 will notify you and the NPC within the timeframes required by the DPA.

Cookies and Tracking Technologies

9.1 What Cookies kh888 Uses

kh888 uses first-party cookies and similar tracking technologies (collectively "Cookies") on the Platform. No third-party advertising cookies are deployed. The Cookies kh888 uses fall into the following categories:

9.2 Cookie Management

Strictly Necessary Cookies cannot be disabled as they are essential to the operation of the Platform. Functional and Analytics Cookies may be managed through your browser settings. Disabling certain cookies may affect the functionality of the Platform. Most modern browsers — including Chrome, Safari, and Firefox — provide cookie management options in their settings panels.

Your Data Subject Rights

Under Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules, you have the following rights with respect to your personal data processed by kh888. These rights are subject to certain limitations where exercise of a right conflicts with kh888's legal obligations (such as AMLA record-keeping requirements) or with the rights of third parties.

To exercise any of these rights, submit a written request to the kh888 DPO using the contact details in Section 15. kh888 will respond within fifteen (15) business days of verified receipt. Requests are processed free of charge for one request per calendar year; additional requests may attract a reasonable administrative fee.

Minors and Age Restriction

The kh888 Platform is strictly restricted to persons who are twenty-one (21) years of age or older, in accordance with PAGCOR regulations and Philippine law. kh888 does not knowingly collect personal data from any person under 21 years of age. If kh888 becomes aware that personal data has been collected from a person under 21 — whether through age misrepresentation during registration or any other means — the following actions will be taken immediately:

1. The Account will be suspended pending investigation;
2. All personal data associated with the underage Account will be flagged for deletion, subject to any overriding legal obligations;
3. Any deposited funds will be returned to the original funding source;
4. The Account will be permanently closed;
5. The matter will be reported to PAGCOR as required by regulation.

If you are a parent or guardian and believe that your child under 21 may have registered on the kh888 Platform, please contact the kh888 support team immediately via live chat or by emailing the DPO at the address in Section 15.

Cross-Border Data Transfers

Where kh888 transfers personal data to third-party service providers (including game studios, cloud hosting providers, or payment processors) whose operations are located outside the Philippines, such transfers are conducted only where adequate data protection safeguards are in place, consistent with the requirements of Section 21 of the Data Privacy Act and the NPC's rules on cross-border data flows.

Safeguards applied to international transfers include contractual data protection clauses binding the recipient to DPA-equivalent standards, the recipient's operation under a jurisdiction recognized by the NPC as providing adequate protection, or the Data Subject's explicit informed consent. kh888 will provide details of applicable safeguards upon written request to the DPO.

Third-Party Platforms and Integrated Services

The kh888 Platform integrates third-party game content from licensed game studios. When you play a game on the kh888 Platform powered by a third-party studio (such as Pragmatic Play, PG Soft, or Jili), session data is transmitted to that studio's servers for the purpose of operating the game. Game studios operating on the kh888 Platform are bound by contractual data processing agreements and are not permitted to use session data for any purpose other than game operation and regulatory compliance.

kh888 is not responsible for the privacy practices of any third-party provider, nor for the content of any external website that may be linked to or from the Platform. Players are encouraged to review the privacy policies of any third-party services they use independently of the kh888 Platform.

Changes to This Privacy Policy

kh888 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, Platform features, regulatory requirements, or applicable law. Where changes are material — affecting the way we process your personal data or the rights available to you — kh888 will provide at least fourteen (14) days' advance notice via the email address registered to your Account and/or via a prominent notification on the Platform before the changes take effect.

Non-material changes — such as clarifications of existing provisions, corrections of grammatical errors, or updates to contact details — may take effect without advance notice and will be reflected in the "Last Revised" date at the top of this Policy. The version number in the document header identifies the current iteration of this Policy.

Your continued use of the Platform after the effective date of any amended Policy constitutes acceptance of the revised terms. If you do not accept the amended Policy, you may close your Account in accordance with the process described in the kh888 Terms & Conditions.

Contact Us and Data Subject Requests

For any questions, concerns, or requests relating to this Privacy Policy, the processing of your personal data, or the exercise of your data subject rights, please contact the kh888 Data Protection Officer through the channels listed below. All data subject rights requests must be submitted in writing and must include sufficient information to verify your identity before kh888 can process the request.

If you are not satisfied with kh888's response to your data subject rights request, or if you believe kh888 has breached its obligations under the Data Privacy Act, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on the NPC's official government website.

For matters related to your Account, game history, or Platform usage that are not privacy-specific, please contact the kh888 support team via live chat. For matters related to responsible gaming tools, self-exclusion, or problem gambling, please visit the Responsible Gaming page.