nurtstar Privacy Policy

This Privacy Policy ("Policy") is issued by nurtstar ("we," "us," "our," or the "Company"), the operator of the online gaming and sports betting platform accessible at nurtstar.club (the "Platform"). This Policy describes how nurtstar collects, processes, stores, shares, and protects the personal data of individuals who access or use the Platform ("Players," "Users," or "you").

nurtstar is committed to upholding the privacy rights of all individuals under the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). Where applicable, nurtstar also observes internationally recognized data protection standards.

This Policy applies to all personal data collected through: the nurtstar website and web application; the account registration and KYC verification process; financial transactions including deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment channels; customer support interactions; and marketing communications where you have provided consent.

Players in Manila, Cebu, Davao, and across the Philippines should read this Policy in conjunction with the nurtstar Terms & Conditions. If there is any conflict between this Policy and the Terms & Conditions on a data privacy matter, this Policy shall prevail.

nurtstar collects personal data in the following categories, depending on how you interact with the Platform:

• Full legal name as it appears on a government-issued Philippine ID;
• Date of birth (used to verify you are at least 21 years of age);
• Residential address, city, and province within the Philippines;
• Philippine mobile number (Globe, Smart, DITO, or other networks);
• Email address used for account registration and communications.

• Scanned or photographed copies of government-issued Philippine identification documents (UMID, driver's license, passport, SSS card, PRC ID, PhilHealth ID, or Postal ID);
• Selfie or facial photograph submitted during identity verification;
• Additional documents required to satisfy enhanced due diligence (EDD) requirements for high-value transactions.

• GCash wallet number or Maya account details linked to your nurtstar account;
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) where used for deposits or withdrawals;
• Deposit and withdrawal amounts, dates, and reference numbers;
• Cryptocurrency wallet addresses where USDT TRC20 transactions are made;
• Transaction history and account balance records.

• Games played, bet amounts, win/loss records, and session durations;
• Responsible gaming settings and self-imposed limits applied to your account;
• Bonus usage, promotional participation, and wagering history.

• IP address and approximate geographic location at time of login;
• Device type, operating system, and browser information;
• Session timestamps and login history;
• Cookies and similar tracking technologies (see Section 6).

• Records of customer support interactions via live chat and email;
• Feedback, complaints, and dispute correspondence;
• Marketing communication preferences and opt-in/opt-out records.

nurtstar uses the personal data it collects for the following purposes:

nurtstar will not use your personal data for any purpose not listed in this Policy without first obtaining your explicit consent or as required by applicable Philippine law. Where we rely on your consent as the legal basis for a specific processing activity (such as marketing emails), you may withdraw that consent at any time by contacting [email protected].

Under the Data Privacy Act of 2012 (RA 10173), nurtstar processes your personal data on one or more of the following lawful bases:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and nurtstar (i.e., the Terms & Conditions), including account creation, transaction processing, and provision of gaming services;
• Legal Obligation: Processing is required for nurtstar to comply with applicable Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (RA 9160, as amended), and the Data Privacy Act itself;
• Legitimate Interests: Processing is necessary for nurtstar's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided such interests do not override your fundamental privacy rights;
• Consent: Where processing is not covered by the above bases, nurtstar will seek your specific, informed, freely given, and unambiguous consent before processing your data. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

nurtstar does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Data is shared only in the circumstances described below:

nurtstar is required by Philippine law to disclose personal data and transaction records to PAGCOR as part of its licensing obligations, and to the Anti-Money Laundering Council (AMLC) where nurtstar's AML monitoring systems identify reportable transactions or suspicious activity. Such disclosures are made pursuant to nurtstar's legal obligations under RA 9160 (AMLA) and PAGCOR regulations and do not require your consent.

nurtstar engages licensed third-party identity verification service providers to assist with KYC processing. These providers receive only the data necessary to perform identity verification and are bound by data processing agreements that prohibit use of your data for any other purpose.

To facilitate deposits and withdrawals, nurtstar shares relevant financial and identity data with payment processors including GCash (GXI), Maya (PayMaya Philippines, Inc.), BancNet, Visa, Mastercard, and other licensed Philippine payment service providers. Data shared with payment processors is limited to what is necessary to process the specific transaction.

Game providers (such as JILI, Pragmatic Play, PG Soft, and Evolution Gaming) receive anonymized Player session data through their game APIs for the purpose of delivering game content and calculating game results. These providers do not receive your full identity data unless required for regulatory purposes specific to their licensing.

nurtstar engages third-party service providers for cloud hosting, email delivery, customer support tools, and cybersecurity services. These providers process personal data on nurtstar's behalf under data processing agreements and are prohibited from using your data for their own purposes.

nurtstar uses cookies and similar tracking technologies to operate the Platform, maintain your login session, prevent fraud, and improve user experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your nurtstar login state and security cookies that protect against cross-site request forgery (CSRF). These cannot be disabled without impairing core Platform functionality;
• Functional Cookies: Remember your preferences such as language settings, game lobby filters, and display preferences to improve your experience on return visits;
• Analytics Cookies: Collect anonymized information about how Players navigate the Platform — page views, session duration, game category preferences — to help nurtstar improve its product. No personally identifiable information is collected through analytics cookies;
• Security & Fraud Prevention Cookies: Used to detect unusual login patterns, identify potentially fraudulent sessions, and verify that Players are human rather than automated bots.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your nurtstar account. nurtstar does not use third-party advertising cookies to deliver targeted advertisements on other websites.

nurtstar retains personal data for the period necessary to fulfill the purposes for which it was collected, subject to longer retention periods required by applicable Philippine law. Specific retention periods are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with nurtstar's data destruction procedures. Data subject to ongoing regulatory investigations or legal proceedings may be retained beyond standard periods until the matter is resolved.

nurtstar implements technical and organizational security measures appropriate to the nature and sensitivity of the personal data it processes. These measures include, but are not limited to:

• Transport Encryption: All data transmitted between your device and the nurtstar Platform is encrypted using 128-bit SSL/TLS protocols. The padlock icon in your browser's address bar confirms that the connection is encrypted;
• Password Security: Account passwords are stored using industry-standard one-way hashing algorithms. nurtstar staff cannot view your password and will never ask you for it;
• Access Controls: Access to personal data within nurtstar's systems is restricted to personnel who require it to perform their job functions, subject to role-based access controls and activity logging;
• KYC Document Storage: Identity verification documents are stored in encrypted cloud storage with strict access controls and are handled only by authorized KYC personnel and compliance officers;
• Two-Factor Authentication: nurtstar offers optional two-factor authentication (2FA) for Player accounts via SMS OTP, adding an additional layer of security to the login process;
• Fraud Monitoring: Automated and manual monitoring systems review transactions and login patterns to detect potential fraud, unauthorized access, and suspicious account activity in real time;
• Incident Response: nurtstar maintains a data breach response procedure. In the event of a personal data breach that poses a risk to Players, nurtstar will notify the National Privacy Commission (NPC) within 72 hours of discovery, as required by RA 10173, and will notify affected Players without undue delay.

Under the Data Privacy Act of 2012 (RA 10173), registered nurtstar Players have the following rights with respect to their personal data. You may exercise these rights by submitting a written request to [email protected] with the subject line "Data Privacy Rights Request":

nurtstar will respond to data rights requests within 30 days of receipt. Where a request is complex or involves a large volume of data, nurtstar may extend this period by an additional 30 days and will notify you of the extension. Identity verification will be required before any data is disclosed or modified in response to a data rights request.

The minimum age to register and use nurtstar is 21 years, as mandated by PAGCOR regulations and Philippine law. Age is verified during the KYC process using a valid Philippine government-issued ID. If nurtstar discovers that it has inadvertently collected personal data from a person under the age of 21, it will immediately suspend the account, void any transactions, and delete the data as promptly as legally permissible.

nurtstar encourages parents and guardians to actively supervise their children's internet usage and to deploy parental control tools to prevent access to online gambling platforms. If you believe a minor has created a nurtstar account, contact us immediately at [email protected] so we can take prompt action.

Some of nurtstar's third-party service providers — including cloud infrastructure providers, game platform operators, and cybersecurity vendors — may be located outside the Philippines. Where personal data is transferred outside the Philippines to such providers, nurtstar ensures that appropriate safeguards are in place in accordance with Section 21 of RA 10173 and the NPC's guidelines on cross-border data transfers.

Safeguards may include: data processing agreements requiring the overseas recipient to observe data protection standards equivalent to RA 10173; standard contractual clauses approved by the National Privacy Commission; or transfers to jurisdictions that the NPC has determined provide an adequate level of data protection.

nurtstar maintains a register of all cross-border data transfers and the safeguards applicable to each, available to the NPC upon request. Players may request information about cross-border transfers affecting their personal data by contacting the nurtstar Data Protection Officer at [email protected].

nurtstar reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, Platform features, or data processing practices. When material changes are made, nurtstar will notify registered Players by email or through an in-platform notification at least 14 days before the changes take effect. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

The current version of this Privacy Policy is always accessible at nurtstar.club/privacy-policy. The "Version" and "Effective Date" displayed in the page header indicate the current revision.

nurtstar has designated a Data Protection Officer (DPO) responsible for overseeing the Company's compliance with RA 10173 and for handling data privacy inquiries and complaints. The DPO can be contacted at:

• Email: [email protected] — Subject: "Data Protection Officer / Data Privacy Inquiry"
• Response Time: Within 5 business days for routine inquiries; within 24 hours for urgent matters relating to potential data breaches

If you have a complaint about how nurtstar has handled your personal data and are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC is the Philippine government body responsible for administering and enforcing RA 10173.