nustar Privacy Policy

1Scope and Application

This Privacy Policy applies to all personal data collected by nustar through the nustar.lat platform, including through the website, mobile browser interface, account registration forms, KYC processes, payment transactions, customer support communications, and any other interaction between you and the nustar platform.

This Policy applies to all registered Players and visitors to the nustar platform, regardless of whether they are located in Metro Manila, Cebu, Davao, Quezon City, or any other part of the Philippines or elsewhere. Where you access the nustar platform from outside the Philippines, you do so on the understanding that your data will be processed in accordance with this Policy and applicable Philippine data protection law.

This Policy should be read together with the nustar Terms & Conditions and Responsible Gaming Policy.

2Data Controller

nustar is the data controller responsible for the personal data you provide or that is collected through your use of the nustar platform. As data controller, nustar determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations.

nustar has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Policy. Contact details for the nustar DPO are set out in Section 16 of this Policy.

3Categories of Personal Data We Collect

nustar collects the following categories of personal data from Players and platform visitors:

3.1 Identity and Registration Data

• Full legal name as it appears on your government-issued Philippine ID
• Date of birth
• Gender
• Philippine residential address
• Active Philippine mobile number (used for account verification and OTP delivery)
• Email address
• Username chosen during registration

3.2 Identity Verification (KYC) Data

• Copies of valid, unexpired Philippine government-issued photo identification documents (UMID, PhilSys National ID, Driver's License, Philippine Passport, or PRC ID)
• Proof of address documents where required
• Proof of payment method ownership
• Selfie or liveness check photograph where required as part of enhanced KYC

3.3 Financial and Transaction Data

• Deposit and withdrawal transaction history including amounts, timestamps, and payment method references
• GCash account reference, Maya account reference, or bank account details used for transactions
• Account balance history
• Bonus activation and wagering activity records

3.4 Platform Activity Data

• Game session history including games played, wager amounts, win/loss outcomes, and session durations
• Login timestamps, IP addresses, and device identifiers
• Browser type, operating system, and device model
• Responsible gaming tool settings (deposit limits, session timers, self-exclusion status)

3.5 Communication Data

• Records of communications between you and the nustar support team via email or in-platform messaging
• Complaint and dispute records
• Preferences for marketing communications where you have provided consent

4How We Collect Your Data

nustar collects personal data through the following means:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or interact with any feature of the nustar platform.
• Automatically — through cookies, session tokens, server logs, and similar technologies that record your device and browsing information when you access the nustar platform. See Section 10 for full details of cookies and tracking.
• From payment processors — nustar receives confirmation data from approved Philippine payment processors (GCash, Maya, BPI, BDO, UnionBank, Coins.ph, and others) to verify deposit and withdrawal transactions.
• From identity verification services — where nustar uses authorised third-party KYC and identity verification service providers as part of the account verification process, those providers may share verification outcome data with nustar.
• From fraud prevention services — nustar may receive data from third-party fraud detection and anti-money-laundering screening services to comply with applicable Philippine financial crime prevention obligations.

5Purposes of Processing

nustar processes your personal data for the following specific purposes:

nustar will not process your personal data for any purpose that is incompatible with those described above without first obtaining your consent or establishing another valid legal basis under the DPA.

6Legal Basis for Processing

nustar processes your personal data on the following legal bases as recognised under the Philippine Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contractual obligations to you under the nustar Terms and Conditions — including account management, payment processing, and provision of gaming services.
• Legal obligation: Processing required to comply with applicable Philippine law — including PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) obligations, and the Data Privacy Act itself.
• Legitimate interests: Processing conducted to pursue nustar's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and improving the platform — where those interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — including the sending of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7Disclosure of Personal Data to Third Parties

7.1 nustar Does Not Sell Your Data

nustar does not sell, rent, or commercially transfer your personal data to third parties for their own independent marketing or commercial purposes.

7.2 Authorised Disclosures

nustar may share your personal data with the following categories of third parties where necessary and lawful:

• Philippine regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government agencies, where disclosure is required by law, court order, or regulatory direction.
• Payment processors: Approved Philippine payment service providers (GCash, Maya, BPI, BDO, UnionBank, Coins.ph, and others) for the purpose of processing your deposit and withdrawal transactions.
• KYC and identity verification providers: Authorised third-party service providers engaged to assist with identity and age verification processes, operating under data processing agreements with nustar.
• Fraud and AML screening services: Specialist third-party providers used to screen transactions and account activity for fraud indicators and money laundering risks, as required under Philippine AMLA obligations.
• Technology and infrastructure providers: Cloud hosting, data centre, and platform infrastructure providers who process data on nustar's behalf under binding data processing agreements.
• Professional advisers: Legal advisers, accountants, and auditors, where disclosure is necessary for the provision of professional services to nustar and subject to obligations of confidentiality.

8Data Security

nustar implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the nustar platform.
• Encryption of sensitive data at rest — personal data and financial records stored in nustar's systems are encrypted using industry-standard algorithms.
• Access controls — access to systems holding personal data is restricted to authorised nustar personnel on a strict need-to-know basis, with role-based access permissions and audit logging.
• Multi-factor authentication for internal systems access and as an optional security feature for Player accounts.
• Regular security assessments and penetration testing of the nustar platform and associated infrastructure.
• Incident response procedures — nustar maintains documented procedures for detecting, investigating, and responding to personal data breaches, including notification to the National Privacy Commission and affected Players where required under the DPA.

9Data Retention

nustar retains personal data for the period necessary to fulfil the purpose for which it was collected, and for such additional periods as required by applicable Philippine law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with Philippine AMLA record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, as required by the AMLA Implementing Rules.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: Retained for a minimum of three (3) years from the date of the communication.
• Marketing consent records: Retained for the duration of the marketing relationship and for a reasonable period thereafter as evidence of consent.

Upon expiry of the applicable retention period, nustar will securely delete or anonymise your personal data in accordance with our data disposal procedures. Data that has been anonymised beyond re-identification is no longer considered personal data and may be retained for statistical or analytical purposes without time limit.

10Cookies and Tracking Technologies

The nustar platform uses cookies and similar tracking technologies to provide a secure and functional user experience. The types of cookies used on the nustar platform include:

• Strictly necessary cookies: Required for the platform to function — including session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional cookies: Used to remember your preferences and settings on the nustar platform, such as language preferences and login status on trusted devices.
• Analytics cookies: Used to collect anonymised or aggregated information about how Players use the nustar platform — including pages visited, features used, and session duration — to help nustar improve the platform experience.
• Security cookies: Used to detect and prevent fraudulent login attempts and to support the integrity of the nustar platform's security monitoring.

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of your nustar account. Instructions for managing cookies in major browsers are available in your browser's Help section.

11Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by nustar. You may exercise any of these rights by contacting nustar's Data Protection Officer at the address set out in Section 16.

nustar will respond to all data subject rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, nustar may extend this period by a further thirty (30) days, with notification to you of the extension and the reasons for it. nustar may request proof of identity before processing a rights request to ensure that data is not disclosed to an unauthorised party.

If you believe nustar has not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC).

12Children's Privacy and Age Restriction

If nustar becomes aware that personal data has been collected from an individual under the age of 21, nustar will promptly close the associated Account, delete the personal data in accordance with our data disposal procedures, and report the incident to PAGCOR as required by the applicable regulatory framework. If you are a parent or guardian and believe that a minor has provided personal data to nustar, please contact us immediately at [email protected].

13Cross-Border Data Transfers

The nustar platform's technology infrastructure may involve the processing of personal data on servers located outside the Philippines — for example, where nustar uses cloud computing services hosted in data centres in other countries. Where personal data is transferred outside the Philippines, nustar ensures that adequate safeguards are in place to protect the data, consistent with the requirements of the Philippine Data Privacy Act.

Adequate safeguards for cross-border transfers used by nustar include binding contractual clauses in data processing agreements with service providers, requiring those providers to apply data protection standards equivalent to those required under Philippine law. nustar does not transfer personal data to jurisdictions that have not implemented adequate data protection frameworks without first establishing contractual protections.

14Third-Party Links and Services

The nustar platform may contain references to third-party game providers and payment processors. While nustar exercises due diligence in selecting service partners, nustar is not responsible for the privacy practices of third-party organisations. Where you interact directly with a third-party payment processor (for example, by completing a transaction within a GCash or Maya interface), that processor's own privacy policy governs the handling of data within their system.

nustar recommends that you review the privacy policies of any third-party services you use in connection with the nustar platform. nustar does not control the data practices of third-party payment processors or game studios.

15Updates to This Privacy Policy

nustar may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or regulatory guidance. Where changes are material, nustar will provide advance notice to registered Players via email or in-account notification before the updated Policy takes effect.

The effective date of the current version of this Policy is stated at the top of this document. We encourage you to review this Policy periodically. Continued use of the nustar platform following the effective date of any update constitutes your acknowledgement of the revised Policy.

16Contact Us & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the personal data nustar holds about you, please contact the nustar Data Protection Officer using the details below. The DPO is responsible for overseeing nustar's compliance with the Philippine Data Privacy Act and is your primary point of contact for all data protection matters.

This Privacy Policy is effective from 1 January 2026 and supersedes all prior versions of the nustar Privacy Policy. nustar is committed to protecting the personal data of every Filipino player on our platform — if you have any concern about how your data is being handled, please do not hesitate to get in touch.