hey33 Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how hey33 ("hey33," "we," "us," or "our") collects, uses, stores, and protects the personal information of players and visitors ("you" or "your") who access or use the hey33 online casino platform at hey33.one (the "Platform").

hey33 is committed to protecting your privacy and handling your personal data with transparency, integrity, and respect. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

By registering an account on hey33 or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform.

02 Data We Collect

hey33 collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is collected. The categories of personal data we collect include:

2.1 Registration & Identity Data

• Full legal name, date of birth, and gender
• Residential address (including city — e.g., Manila, Cebu, Davao, Quezon City, Makati)
• Email address and mobile phone number
• Username and encrypted password
• Government-issued ID details (e.g., Philippine passport, SSS ID, PhilSys National ID, UMID) submitted for KYC verification

2.2 Financial Data

• GCash or PayMaya account details (mobile number only — we do not store PINs or passwords)
• BPI, BDO, or Metrobank account details submitted for bank transfer transactions
• Transaction history, deposit amounts, withdrawal amounts, and account balances

2.3 Gaming Activity Data

• Game session logs, bet history, win/loss records, and wagering patterns
• Bonus usage, promotional participation, and loyalty program activity
• Responsible gaming settings such as deposit limits and self-exclusion records

2.4 Technical & Device Data

• IP address, device type, operating system, and browser type
• Geolocation data (country and region level) for compliance and fraud prevention purposes
• Session timestamps, login history, and Platform navigation data
• Cookie identifiers and similar tracking technologies (see Section 6)

2.5 Communications Data

• Records of your communications with hey33 customer support via live chat or email
• Feedback, survey responses, and complaint records

03 How We Use Your Data

hey33 uses your personal data for the following purposes:

04 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, hey33 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfill our obligations under the hey33 Terms & Conditions, including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable Philippine laws and regulations, including anti-money laundering (AML) laws, PAGCOR regulatory requirements, and tax obligations.
• Legitimate Interests: Processing necessary for hey33's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and optional analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.

05 Data Sharing & Third Parties

hey33 does not sell, rent, or trade your personal data. We may share your data with carefully selected third parties only in the following circumstances:

• Payment Processors: GCash, PayMaya, BPI, BDO, and Metrobank receive the minimum data necessary to process your financial transactions. These providers are bound by their own privacy policies and applicable Philippine financial regulations.
• Identity Verification Providers: Third-party KYC service providers may process your identity documents to verify your age and identity. These providers are contractually bound to process data only for verification purposes.
• Game Software Providers: Game providers may receive anonymized session data necessary to deliver their games on the hey33 platform. They do not receive your full identity or financial data.
• Regulatory Authorities: hey33 may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine authorities when required by law or court order.
• IT & Security Service Providers: Cloud hosting, cybersecurity, and analytics providers who process data on our behalf under strict data processing agreements that prohibit independent use of your data.

All third-party service providers engaged by hey33 are required to implement appropriate technical and organizational security measures and to process personal data only in accordance with hey33's instructions and applicable law.

06 Cookies & Tracking Technologies

hey33 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyze usage patterns. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without affecting Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display options, and responsible gaming limits you have set.
• Analytics Cookies: Help us understand how players use the Platform so we can improve it. Data collected is aggregated and anonymized where possible.
• Security Cookies: Used for fraud detection, bot prevention, and to protect the integrity of the Platform and your account.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the hey33 Platform. hey33 does not use third-party advertising or behavioral tracking cookies.

07 Data Retention

hey33 retains your personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable Philippine law. Our general retention periods are as follows:

• Active Account Data: Retained for the duration of your account's active status plus five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act of 2001 (RA 9160, as amended).
• KYC Documents: Retained for five (5) years following account closure or the last transaction, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the last interaction.
• Marketing Consent Records: Retained until you withdraw consent, plus one (1) year for compliance documentation purposes.
• Technical Logs: Retained for up to twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not immediately possible due to technical constraints, the data is isolated and protected from further processing until deletion can be completed.

08 Security Measures

hey33 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption: All data in transit is protected by TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256.
• Access Controls: Access to personal data is restricted to authorized hey33 personnel on a strict need-to-know basis. All staff with data access undergo regular privacy and security training.
• Two-Factor Authentication: hey33 supports and encourages the use of two-factor authentication (2FA) for player accounts to add an additional layer of security.
• Penetration Testing: hey33's systems undergo regular independent security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: hey33 maintains a documented data breach response plan. In the event of a breach affecting your personal data, we will notify you and the NPC within 72 hours as required by RA 10173.

09 Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by hey33:

• Right to be Informed: The right to know what personal data hey33 collects about you and how it is used — which is the purpose of this Privacy Policy.
• Right of Access: The right to request a copy of the personal data hey33 holds about you, along with information about how it is processed.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of these rights, please contact hey33's Data Protection Officer (DPO) using the contact details in Section 13. We will respond to all valid requests within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days, with prior notification to you.

10 Minors & Age Restriction

The hey33 Platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. hey33 does not knowingly collect personal data from individuals under the age of 21.

If hey33 discovers or is notified that personal data has been collected from a person under 21 years of age, we will immediately close the associated account, void any transactions, and securely delete all personal data collected from that individual.

If you are a parent or guardian and believe that your child has registered on hey33, please contact our support team immediately via live chat or at the email address provided in Section 13.

11 International Data Transfers

hey33 primarily stores and processes your personal data within the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or game software vendors operating internationally.

Where such transfers occur, hey33 ensures that appropriate safeguards are in place to protect your personal data, including contractual clauses that require the recipient to provide a level of data protection equivalent to that required under Philippine law. hey33 will not transfer your personal data to jurisdictions that do not provide adequate data protection standards without your explicit consent or a lawful basis for doing so.

12 Changes to This Policy

hey33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, we will notify registered players via email or a prominent notice on the Platform at least seven (7) days before the changes take effect.

The updated Policy will always be available at hey33.one/privacy-policy with the effective date clearly indicated at the top of the page. Your continued use of the hey33 Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

If you disagree with any changes to this Policy, you may request account closure in accordance with the hey33 Terms & Conditions. Please review our Terms & Conditions for the account closure procedure.

13 Contact & Data Protection Officer

hey33 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012. If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly within the hey33 Platform after login — the fastest way to reach our support team.
• DPO Email: [email protected]
• General Support Email: [email protected]
• Response Time: Data rights requests are acknowledged within 3 business days and resolved within 30 calendar days.

If you are not satisfied with hey33's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC). Information about filing a complaint with the NPC is available through official Philippine government channels.