Privacy Policy of inato.ph

1 Introduction

inato.ph ("we," "us," or "our") is committed to protecting the privacy and personal data of all users who access and use our online gaming platform. This Privacy Policy describes how inato.ph collects, uses, stores, shares, and protects personal information in connection with the services we provide.

This policy is issued in compliance with the Data Privacy Act of the Philippines (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). We take our obligations under this law seriously and have appointed a Data Protection Officer (DPO) to oversee our compliance.

We encourage you to read this policy carefully. If you have questions about how we handle your personal data, please contact our DPO using the details provided in Section 14 of this policy.

2 Data Controller

For the purposes of the Data Privacy Act of the Philippines, the data controller responsible for your personal information is inato.ph, operating the platform accessible at https://inatoph.org.

As data controller, inato.ph determines the purposes and means of processing your personal data. We are responsible for ensuring that your data is handled lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable Philippine law.

3 Data We Collect

inato.ph collects personal data that is necessary to provide our services, comply with legal obligations, and maintain the security and integrity of our platform. The categories of personal data we collect include:

3.1 Registration & Identity Data

• Full legal name
• Date of birth (to verify you are 21 years of age or older)
• Email address
• Mobile phone number
• Residential address (including city, province, and postal code)
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Government-issued identification documents (e.g., Philippine passport, driver's license, SSS/GSIS ID, PhilSys National ID)
• Proof of address documents
• Selfie or facial image for identity matching purposes
• Proof of payment method ownership

3.3 Financial Data

• GCash or Maya account reference (masked)
• Bank account details (masked, for withdrawal processing)
• Debit card details (masked)
• Transaction history, including deposits, withdrawals, and wager records

3.4 Usage & Technical Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session duration, pages visited, and features used
• Game history and betting patterns
• Login timestamps and access logs

3.5 Communications Data

• Records of your communications with our customer support team
• Feedback, survey responses, and promotional opt-in preferences

4 How We Use Your Data

inato.ph uses your personal data for the following purposes:

5 Legal Basis for Processing

inato.ph processes your personal data on the following legal bases under the Data Privacy Act of the Philippines:

• Contractual necessity: Processing required to fulfill our obligations under the Terms & Conditions you agreed to upon registration, including account management and payment processing.
• Legal obligation: Processing necessary to comply with Philippine law, including the Anti-Money Laundering Act, Data Privacy Act, and PAGCOR licensing requirements.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing

inato.ph does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your data only in the following limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers to assist in operating the inato.ph platform, including payment processors (GCash, Maya, banks), identity verification providers, cloud hosting providers, and customer support platforms. These providers are contractually bound to process your data only on our instructions and in accordance with applicable privacy law.

6.2 Regulatory & Law Enforcement Authorities

We may disclose your personal data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), PAGCOR, or other competent Philippine authorities where required by law, court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of inato.ph's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy protections that apply.

7 Cookies & Tracking Technologies

inato.ph uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and analyze how the platform is used.

7.1 Types of Cookies We Use

• Essential cookies: Required for the platform to function correctly, including session management and security features. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and display options to personalize your experience.
• Analytics cookies: Help us understand how users interact with the platform so we can improve performance and content. Data collected is aggregated and anonymized.
• Marketing cookies: Used to deliver relevant promotional content where you have consented to receive marketing communications.

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of the inato.ph platform.

8 Data Retention

inato.ph retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account data: Retained for the duration of your account and for five (5) years following account closure, in compliance with AML record-keeping requirements.
• KYC and identity documents: Retained for five (5) years from the date of verification or account closure, whichever is later.
• Transaction records: Retained for five (5) years in accordance with the Anti-Money Laundering Act.
• Customer support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained until you withdraw consent, plus one (1) year for compliance documentation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with you.

9 Data Security

inato.ph implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and our servers.
• Encryption of sensitive data at rest, including financial information and identity documents.
• Role-based access controls ensuring that only authorized personnel can access personal data on a need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing.
• Two-factor authentication (2FA) available for all user accounts.
• Incident response procedures to detect, report, and address personal data breaches promptly.

10 Your Rights

Under the Data Privacy Act of the Philippines, you have the following rights with respect to your personal data held by inato.ph:

• Right to be informed: You have the right to know what personal data we collect, how we use it, and with whom we share it — which is the purpose of this Privacy Policy.
• Right of access: You may request a copy of the personal data we hold about you at any time.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14. We will respond to all verified requests within fifteen (15) business days, as required by the Data Privacy Act.

11 Children's Privacy

The inato.ph platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from persons under 21 years of age. If we become aware that personal data has been collected from an underage individual, we will immediately close the associated account and delete all related personal data.

If you are a parent or guardian and believe that a minor has registered on inato.ph, please contact us immediately at [email protected] so that we can take appropriate action.

12 Cross-Border Data Transfers

inato.ph primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data to service providers or infrastructure located outside the Philippines (for example, cloud hosting services), we ensure that such transfers are subject to appropriate safeguards, including contractual data protection clauses that provide a level of protection equivalent to that required under the Data Privacy Act of the Philippines.

We will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without your explicit consent or without implementing appropriate safeguards as required by the NPC.

13 Changes to This Policy

inato.ph may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes, we will notify registered users via email or a prominent notice on the platform at least fourteen (14) days before the changes take effect.

The "Last updated" date at the top of this page indicates when the policy was most recently revised. We encourage you to review this policy periodically to stay informed about how inato.ph protects your personal data.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have been violated. The NPC can be reached through their official government channels.