vivi7 Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") describes how vivi7 ("we," "us," or "our"), the operator of the online gaming platform accessible at vivi7.app, collects, uses, stores, shares, and protects personal data relating to individuals ("you," "your," or "Data Subject") who visit our website, register an account, or otherwise interact with our platform.

1.2 This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines. We are also guided by the PAGCOR regulatory framework applicable to licensed online gaming operators.

1.3 By accessing the vivi7 platform, creating an account, or submitting any personal information to us, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the platform and contact support to request account closure.

1.4 This Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, which together form the complete framework governing your use of vivi7.

2. Data Controller Information

2.1 For purposes of the Data Privacy Act of 2012, vivi7 acts as the Personal Information Controller (PIC) in respect of personal data collected through the vivi7.app platform. As PIC, vivi7 determines the purposes and means of processing your personal data and is accountable for ensuring that processing is conducted lawfully, fairly, and transparently.

2.2 vivi7 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with the DPA. The DPO may be contacted via the details provided in Section 14 of this Policy. All data-related inquiries, complaints, and requests to exercise data subject rights should be directed to the DPO in the first instance.

2.3 Third-party service providers engaged by vivi7 to process personal data on our behalf — including payment processors, KYC providers, and game studio partners — act as Personal Information Processors (PIPs) and are contractually bound to process data only on vivi7's documented instructions and in accordance with applicable Philippine data protection law.

3. Personal Data We Collect

3.1 vivi7 collects only the personal data that is necessary for the specific, legitimate purposes described in this Policy. The categories of personal data we collect include:

3.2 vivi7 does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, religious beliefs, or political affiliations) unless you voluntarily disclose such information in a support communication. Where such information is received incidentally, it will be handled with heightened protection and deleted as soon as it is no longer necessary.

3.3 You are not legally required to provide personal data to vivi7. However, certain data is technically necessary for account registration, identity verification, and payment processing. Failure to provide required data may result in our being unable to open or maintain your account or process financial transactions.

4. How We Collect Your Data

4.1 Directly from you: Most personal data is collected directly when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, respond to a survey, or otherwise interact with the platform.

4.2 Automatically through technology: When you visit vivi7.app, our servers automatically record technical data including your IP address, device identifiers, and session data. We use cookies and similar tracking technologies as described in Section 9 of this Policy.

4.3 From third-party service providers: We may receive data about you from our KYC verification providers (identity confirmation, sanctions screening), payment processors (transaction status, payment method verification), and fraud detection services. This data is used solely to supplement the information you provide directly and is processed under the same protections as data collected directly.

4.4 From publicly available sources: Where permitted by applicable law and required for anti-money laundering (AML) compliance or fraud prevention, vivi7 may reference publicly available records to verify information you have provided.

5. Purpose & Legal Basis for Processing

5.1 vivi7 processes your personal data only where we have a lawful basis for doing so under the Data Privacy Act of 2012. The primary legal bases and corresponding processing purposes are:

• Performance of a contract: Processing necessary to register your account, authenticate your identity, process deposits and withdrawals, manage your account wallet, and deliver the gaming services you have requested.
• Legal obligation: Processing required to comply with PAGCOR regulatory requirements, Philippine Anti-Money Laundering Act (AMLA) obligations, Know Your Customer (KYC) requirements, tax reporting obligations, and any lawful order issued by Philippine regulatory or law enforcement authorities.
• Legitimate interests: Processing necessary for fraud prevention, platform security, detection and investigation of prohibited conduct, improvement of platform features, and risk management — where these interests are not overridden by your rights as a data subject.
• Consent: Where we send you optional promotional communications or use non-essential cookies, we rely on your freely given, informed consent, which you may withdraw at any time.

5.2 vivi7 does not use your personal data for automated decision-making processes that produce legal or similarly significant effects on you without human review. Account risk assessments and fraud flags are reviewed by a compliance team member before any material action is taken against an account.

6. Data Sharing & Disclosure

6.1 vivi7 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data is shared externally only in the following circumstances:

• KYC and identity verification providers: We share identity documents and personal details with accredited KYC service providers to verify your age and identity as required by PAGCOR regulations.
• Payment processors: Financial data necessary to process your GCash, PayMaya, BPI, BDO, or Metrobank transactions is shared with the relevant payment service providers solely for transaction fulfillment purposes.
• Game studio providers: Usage data and account identifiers may be shared with third-party game studios (such as JILI and others) to deliver their gaming content within the vivi7 platform. These providers process data under their own applicable licenses and data protection agreements.
• Regulatory and law enforcement authorities: vivi7 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities where required by law, court order, or regulatory directive.
• Fraud prevention and security services: Technical and identity data may be shared with fraud detection platforms to identify and prevent account abuse, money laundering, and other prohibited conduct.
• Professional advisers: Legal counsel, auditors, and compliance consultants engaged by vivi7 may access personal data where necessary for the provision of professional services, subject to confidentiality obligations.

6.2 All third-party processors engaged by vivi7 are required to enter into data processing agreements that bind them to process personal data only on vivi7's documented instructions, to maintain appropriate security measures, and to comply with the Data Privacy Act of 2012 and its IRR.

7. Data Retention

7.1 vivi7 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or for such longer period as is required by applicable law or regulation. The general retention periods we apply are:

• Active account data: Retained throughout the life of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and Philippine AMLA obligations.
• KYC documents: Retained for a minimum of five (5) years from the date of submission or from account closure, whichever is later, as required by AMLC regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Support communications: Retained for two (2) years from the date of last communication, unless a longer period is required by an ongoing investigation or dispute.
• Technical and usage data: Retained for twelve (12) months on an identifiable basis, after which it may be retained in aggregated, anonymized form for platform analytics purposes without limitation.

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction of any identifying information.

8. Security Measures

8.1 vivi7 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your browser and our servers.
• Encryption of sensitive data fields (including payment credentials and KYC document storage) at rest.
• Role-based access controls ensuring that only personnel with a legitimate operational need can access personal data.
• Multi-factor authentication requirements for internal staff accessing systems that process personal data.
• Regular security assessments, penetration testing, and vulnerability scanning of platform infrastructure.
• Incident response procedures aligned with NPC breach notification requirements under the DPA IRR.

8.2 In the event of a personal data breach that is likely to adversely affect your rights and freedoms, vivi7 will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay as required by law.

8.3 While vivi7 takes security seriously and maintains robust safeguards, no internet-based system can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying vivi7 support immediately if you suspect unauthorized access to your account.

9. Cookies & Tracking Technologies

9.1 vivi7 uses cookies and similar technologies (including local storage and session identifiers) to operate and improve the platform. Cookies are small text files stored on your device that help us recognize your browser, maintain your session, and gather analytics data.

9.2 The types of cookies used on vivi7.app are:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens and security cookies. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming tool configurations.
• Analytics Cookies: Help us understand how players use the platform — which pages are visited, which games are played most, and where users encounter difficulties. Data collected is aggregated and used solely for platform improvement.
• Security Cookies: Assist in detecting and preventing fraudulent activity, unauthorized login attempts, and bot behavior.

9.3 Non-essential cookies (functional and analytics) are deployed only with your consent, which you may manage through your browser settings or our cookie preference interface. Withdrawing consent for non-essential cookies will not affect your ability to use the core gaming platform.

10. Protection of Minors

10.1 vivi7 is strictly an adult platform. In accordance with PAGCOR regulations and Philippine law, participation in online casino and sports betting activities is permitted only for individuals aged 21 years and above. vivi7 does not knowingly collect or process personal data from individuals under the age of 21.

10.2 Age verification is a mandatory component of our KYC process. Any account found to belong to a person under 21 years of age will be immediately closed, all personal data will be deleted or anonymized in accordance with our legal obligations, and any funds will be handled per PAGCOR guidelines.

10.3 If you become aware that a minor has registered on the vivi7 platform or has provided personal data to us, please notify our Data Protection Officer immediately at the contact details in Section 14 so that we can take prompt remedial action.

11. Your Rights as a Data Subject

11.1 Under the Philippine Data Privacy Act of 2012, you are entitled to the following rights in respect of your personal data held by vivi7:

11.2 To exercise any of the rights listed above, please submit a written request to our Data Protection Officer using the contact details in Section 14. We will acknowledge your request within three (3) business days and will respond substantively within fifteen (15) business days, or within any extended period permitted under the DPA IRR where the request is complex or voluminous.

11.3 vivi7 will not charge a fee for processing data subject rights requests unless the request is manifestly unfounded or excessive. We may request proof of identity before fulfilling any access, rectification, or deletion request to ensure we do not disclose data to unauthorized persons.

12. Cross-Border Data Transfers

12.1 As an online gaming platform serving the Philippine market, certain of our service providers and game studio partners are located outside the Philippines. Where personal data is transferred to a recipient in another jurisdiction, vivi7 takes steps to ensure that an adequate level of protection is maintained, including:

• Entering into data transfer agreements that incorporate the standard contractual clauses or equivalent protections recognized by the National Privacy Commission.
• Ensuring that recipient jurisdictions provide an adequate level of data protection comparable to that afforded by the DPA of 2012.
• Conducting transfer impact assessments where transfers involve jurisdictions identified as higher-risk by the NPC.

12.2 Details of the specific countries to which your data may be transferred and the safeguards applied are available upon request from our Data Protection Officer.

13. Changes to This Privacy Policy

13.1 vivi7 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The effective date displayed in the hero section of this page will be updated whenever a material revision is made.

13.2 Where changes are material — meaning they substantively affect how your personal data is processed or your rights as a data subject — vivi7 will provide advance notice via your registered account email or through a prominent in-platform notification, with a minimum of seven (7) days before the revised Policy takes effect.

13.3 Your continued use of the vivi7 platform after the revised Policy's effective date constitutes your acknowledgment of and agreement to the updated terms. If you do not accept the revised Policy, you should discontinue platform use and may request account closure in accordance with the Terms & Conditions.

14. Contact & Data Protection Officer

14.1 For all data privacy matters — including requests to exercise your data subject rights, questions about this Policy, or concerns about how your personal data is being processed — please contact vivi7's Data Protection Officer through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available directly within the vivi7 platform, 24 hours a day, 7 days a week. Reference "Data Privacy Request" at the start of your message.

14.2 If you are not satisfied with vivi7's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.

14.3 For responsible gaming concerns, separate from data privacy matters, please visit our dedicated Responsible Gaming page or access the responsible gaming tools within your account settings.