Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes the personal information processing practices of nustal ("we," "us," "our," or "nustal"), the operator of the online casino platform located at nustal.cam (the "Platform"). This Policy applies to all users, visitors, players, and any person who accesses or uses nustal services.

nustal is a data controller for the purposes of Philippine data protection law. We are committed to transparency in our data processing activities and compliance with all applicable privacy regulations. This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the Platform.

1.1 Scope of This Policy

This Privacy Policy covers:

• Personal information collected through the nustal Platform, including our website and mobile applications;
• Information collected when you register an account, make deposits or withdrawals, or use our gaming services;
• Data obtained through customer support interactions, promotional activities, and marketing communications;
• Technical information collected through cookies, log files, and similar tracking technologies;
• Information shared with us by payment processors and other third-party service providers.

1.2 Acceptance of This Policy

By creating a nustal account or using any of our services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with our data practices, you should not use nustal services and must immediately cease accessing the Platform.

2. Information We Collect

nustal collects various categories of personal information to provide, maintain, and improve our services, comply with legal obligations, and protect the security of our Platform and users.

2.1 Information You Provide Directly

When you register for a nustal account and use our services, you provide us with the following information:

Data Category	Examples	Purpose
Identity Information	Full name, date of birth, gender, nationality, government-issued ID numbers	Account creation, age verification, KYC compliance, fraud prevention
Contact Information	Email address, phone number, residential address	Account management, customer support, marketing communications, legal notifications
Financial Information	Payment method details, GCash/Maya account information, bank account numbers, transaction history	Processing deposits and withdrawals, payment verification, anti-money laundering compliance
Account Credentials	Username, password, security questions and answers	Account access, authentication, security
Verification Documents	Government-issued ID (passport, driver's license, UMID), proof of address (utility bills, bank statements), selfie photos	Identity verification (KYC), regulatory compliance, fraud prevention
Communication Data	Customer support inquiries, live chat transcripts, email correspondence, survey responses	Customer service, problem resolution, service improvement

2.2 Information Collected Automatically

When you access and use the nustal Platform, we automatically collect certain technical and usage information:

• Device Information: Device type, operating system, browser type and version, unique device identifiers, mobile network information;
• Connection Data: IP address, internet service provider, geographic location (country, city, region);
• Usage Data: Pages visited, games played, betting patterns, session duration, clickstream data, referral sources;
• Gaming Activity: Bets placed, wins and losses, game preferences, wagering history, bonus usage, responsible gaming tool settings;
• Log Files: Access times, error logs, system activity, security events;
• Cookies and Tracking Technologies: Session cookies, persistent cookies, web beacons, pixel tags, local storage objects.

2.3 Information from Third Parties

We may receive personal information about you from third-party sources, including:

• Payment Processors: GCash, Maya, banks, and cryptocurrency payment gateways provide transaction verification and payment method authentication;
• Identity Verification Services: Third-party KYC and anti-fraud providers verify the authenticity of identification documents;
• Affiliate Partners: Marketing affiliates may share referral information when you sign up through their promotional links;
• Public Databases: Publicly available information from government registries and credit bureaus for fraud prevention and compliance purposes;
• Social Media Platforms: If you choose to link social media accounts, we may receive profile information you have made publicly available.

2.4 Special Categories of Data

nustal processes certain sensitive personal information only when necessary for legal compliance or legitimate business purposes with appropriate safeguards. This includes biometric data (facial recognition for identity verification) and information relating to potential gambling problems (self-exclusion requests, responsible gaming tool usage). We process such data with heightened security measures and in accordance with applicable Philippine law.

3. How We Use Your Information

nustal processes your personal information for the following purposes, based on legitimate legal grounds under Philippine data protection law:

3.1 Service Provision and Account Management

We use your information to:

• Create and maintain your nustal account;
• Authenticate your identity and verify your eligibility to use our services;
• Process deposits, withdrawals, and other financial transactions;
• Provide access to games, sports betting, and other gambling services;
• Track your betting activity, account balance, and transaction history;
• Apply bonuses and promotions to your account;
• Enable responsible gaming tools such as deposit limits, self-exclusion, and session timers;
• Respond to customer support inquiries and resolve technical issues.

3.2 Legal and Regulatory Compliance

We process personal data to comply with legal obligations imposed by:

• Anti-Money Laundering Laws: Verifying customer identities, monitoring transactions for suspicious activity, and reporting to the Anti-Money Laundering Council (AMLC) as required;
• Know Your Customer (KYC) Requirements: Conducting due diligence on customers through identity verification and ongoing monitoring;
• Gambling Regulations: Ensuring players meet minimum age requirements, maintaining records of gaming activity, and preventing underage gambling;
• Tax Compliance: Reporting winnings and withholding taxes as required under Philippine law;
• Data Retention Obligations: Maintaining records for the periods specified by law and regulatory authorities;
• Legal Proceedings: Responding to court orders, subpoenas, and lawful requests from government authorities.

3.3 Fraud Prevention and Security

To protect nustal and our users from fraudulent activities, we use your information to:

• Detect and prevent account takeover, identity theft, and payment fraud;
• Monitor for unusual betting patterns, bonus abuse, and collusion;
• Identify and block duplicate accounts and multi-accounting violations;
• Prevent unauthorized access to accounts and systems;
• Investigate security incidents and potential breaches;
• Enforce our Terms & Conditions and other policies;
• Cooperate with law enforcement in criminal investigations.

3.4 Marketing and Communications

With your consent, we use your contact information to:

• Send promotional emails about new games, bonuses, and special offers;
• Deliver personalized marketing messages based on your preferences and gaming history;
• Send SMS notifications about account activity, promotions, and updates;
• Provide updates about changes to our services, policies, and terms;
• Conduct customer satisfaction surveys and request feedback;
• Send transactional communications related to your account (confirmation emails, withdrawal notifications, security alerts).

You may opt out of marketing communications at any time by clicking the unsubscribe link in emails or adjusting your account communication preferences. Transactional and security-related communications cannot be opted out as they are necessary for service provision.

3.5 Service Improvement and Analytics

We analyze usage data to:

• Understand how users interact with the Platform and identify areas for improvement;
• Optimize game selection, payment methods, and user interface design;
• Develop new features and services based on user preferences;
• Measure the effectiveness of marketing campaigns and promotions;
• Create aggregated, anonymized reports about platform usage and trends;
• Test new features and conduct A/B testing to improve user experience.

3.6 Responsible Gaming

We use gaming activity data to:

• Monitor for signs of problem gambling behavior;
• Implement and enforce responsible gaming tools (deposit limits, loss limits, session reminders, reality checks);
• Process self-exclusion requests and prevent excluded players from accessing the Platform;
• Provide interventions and support resources for players who may need assistance;
• Comply with regulatory requirements for player protection.

4. Data Sharing and Disclosure

nustal does not sell your personal information to third parties. We share your data only in the limited circumstances described below, with appropriate safeguards to protect your privacy.

4.1 Service Providers

We engage third-party service providers to perform functions on our behalf. These providers have access to personal information only as necessary to perform their services and are contractually obligated to protect your data. Service providers include:

• Payment Processors: GCash, Maya, banks, and cryptocurrency payment gateways process deposits and withdrawals;
• Identity Verification Services: KYC providers verify identity documents and perform anti-fraud checks;
• Game Providers: Third-party game developers and platform providers supply gaming content;
• Cloud Hosting Services: Infrastructure providers host our Platform and store data securely;
• Customer Support Software: CRM and helpdesk platforms manage customer inquiries and support tickets;
• Marketing and Analytics Tools: Email service providers, analytics platforms, and advertising networks support marketing activities;
• Security Services: Anti-fraud, anti-malware, and cybersecurity providers protect the Platform from threats.

4.2 Legal and Regulatory Authorities

We may disclose personal information to government authorities, regulators, and law enforcement when:

• Required by law, regulation, legal process, or court order;
• Necessary to comply with gambling licensing requirements and regulatory oversight;
• Requested by the Anti-Money Laundering Council (AMLC) or other financial crime authorities;
• Responding to subpoenas, warrants, or lawful information requests;
• Investigating suspected criminal activity, fraud, or violations of our Terms & Conditions;
• Protecting the rights, property, or safety of nustal, our users, or the public;
• Enforcing our legal rights or defending against legal claims.

4.3 Business Transfers

If nustal is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your personal information may be transferred to the acquiring entity or successor organization. We will notify you of any such transfer and any choices you may have regarding your information.

4.4 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. Such data may be used for industry research, market analysis, or shared with business partners and the public without restriction.

4.5 With Your Consent

We may share your personal information for purposes not described in this Policy with your explicit consent. You may withdraw consent at any time, though withdrawal will not affect the lawfulness of processing conducted prior to consent withdrawal.

5. Cookies and Tracking Technologies

nustal uses cookies, web beacons, pixel tags, and similar tracking technologies to enhance user experience, analyze Platform usage, and deliver personalized content.

5.1 What Are Cookies

Cookies are small text files stored on your device when you visit websites. They enable websites to remember your actions and preferences over time, so you do not have to re-enter information when navigating between pages or returning to the site later.

5.2 Types of Cookies We Use

• Essential Cookies: Necessary for the Platform to function properly. These cookies enable account login, secure transactions, fraud prevention, and basic navigation. Essential cookies cannot be disabled without impairing core functionality.
• Performance Cookies: Collect information about how users interact with the Platform, including pages visited, error messages, and loading times. This data helps us optimize performance and troubleshoot issues. All data is aggregated and anonymous.
• Functional Cookies: Remember your preferences and settings, such as language selection, preferred payment methods, and display options, to provide a personalized experience.
• Marketing Cookies: Track your activity across websites to deliver relevant advertising and measure campaign effectiveness. These cookies may be set by third-party advertising networks and require your consent.
• Analytics Cookies: Help us understand user behavior through tools like Google Analytics, including traffic sources, popular content, and user journeys. This information is used to improve the Platform and our services.

5.3 Managing Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies, though disabling essential cookies may prevent you from using certain Platform features. To opt out of analytics cookies, you can use browser extensions or privacy tools. Marketing cookies can be managed through your account settings or by visiting advertising industry opt-out pages.

5.4 Third-Party Cookies

Some cookies are placed by third parties whose services we use. We do not control these cookies or how third parties use them. Third-party cookies are subject to the privacy policies of those third parties.

6. Data Security Measures

nustal implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

6.1 Technical Security Controls

• Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 protocol. Personal information stored in our databases is encrypted at rest using AES-256 encryption.
• Access Controls: Role-based access controls ensure only authorized personnel can access personal data. All access is logged, monitored, and regularly audited.
• Secure Infrastructure: Our Platform is hosted on secure, redundant servers with firewalls, intrusion detection systems, and DDoS protection.
• Authentication: Multi-factor authentication is required for administrative access. Player accounts can enable two-factor authentication for enhanced security.
• Regular Security Testing: We conduct penetration testing, vulnerability assessments, and security audits to identify and remediate potential weaknesses.
• Incident Response: We maintain an incident response plan to detect, investigate, and respond to security breaches promptly.

6.2 Organizational Security Measures

• Staff Training: All employees receive data protection training and are bound by confidentiality obligations.
• Background Checks: Employees with access to personal data undergo background screening.
• Data Protection Policies: Internal policies govern data handling, access, retention, and disposal.
• Vendor Management: Third-party service providers are carefully vetted and must comply with our security standards.
• Business Continuity: Backup and disaster recovery procedures ensure data availability and resilience.

6.3 Your Security Responsibilities

While we implement robust security measures, you also play a critical role in protecting your account:

• Choose a strong, unique password and do not share it with anyone;
• Enable two-factor authentication for additional account protection;
• Keep your contact information current so we can notify you of security issues;
• Log out of your account when using shared or public devices;
• Do not access your account over unsecured public Wi-Fi networks;
• Be vigilant against phishing attempts and verify the authenticity of communications claiming to be from nustal;
• Immediately report any suspected unauthorized access to your account.

6.4 Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the National Privacy Commission within 72 hours of becoming aware of the breach, as required by Philippine law. The notification will include the nature of the breach, the data affected, the likely consequences, and the measures we are taking to address the incident.

7. Data Retention

nustal retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

7.1 Retention Periods by Data Type

• Account Information: Retained for the duration of your account's active status and for five (5) years after account closure to comply with anti-money laundering and gambling regulations.
• Transaction Records: Retained for seven (7) years from the date of the transaction to satisfy financial recordkeeping and tax reporting obligations under Philippine law.
• Identity Verification Documents: Retained for five (5) years after account closure or relationship termination for KYC and compliance purposes.
• Gaming Activity Logs: Retained for three (3) years to support dispute resolution, responsible gaming monitoring, and regulatory compliance.
• Marketing Communications Data: Retained until you withdraw consent or request deletion, or for two (2) years of inactivity.
• Customer Support Records: Retained for three (3) years to track service quality and resolve recurring issues.
• Security Logs: Retained for one (1) year for security monitoring, incident investigation, and fraud prevention.
• Aggregated Analytics Data: May be retained indefinitely in anonymized form for business intelligence and research purposes.

7.2 Criteria for Determining Retention Periods

When determining how long to retain personal data, we consider:

• Legal and regulatory obligations under Philippine law and licensing requirements;
• The purposes for which the data was collected and whether those purposes remain valid;
• The need to maintain data for dispute resolution, litigation, or investigation;
• Your preferences and requests for data deletion;
• Industry best practices and data minimization principles.

7.3 Secure Data Disposal

When personal information is no longer needed, we securely delete or anonymize it using industry-standard methods. Deletion procedures include overwriting data, cryptographic erasure, and physical destruction of storage media where appropriate. We maintain records of data disposal activities for audit purposes.

8. Your Privacy Rights

Under the Data Privacy Act of 2012 and other applicable Philippine laws, you have the following rights regarding your personal information:

8.1 Right to Access

You have the right to request confirmation of whether we process your personal data and to obtain a copy of that data. You may request details about the purposes of processing, the categories of data processed, the recipients to whom data has been disclosed, and the retention periods applied. To exercise this right, contact our Data Protection Officer.

8.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information. You may update most account information directly through your account settings. For other corrections, contact customer support with the updated information and supporting documentation if needed.

8.3 Right to Erasure

You have the right to request deletion of your personal information in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when the data has been unlawfully processed. This right is not absolute and may be subject to legal retention obligations.

8.4 Right to Restrict Processing

You have the right to request limitation of how we process your personal data when you contest the accuracy of the data, when processing is unlawful but you prefer restriction over deletion, or when you need the data for legal claims even though we no longer need it for our purposes.

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another service provider where technically feasible. This right applies to data you have provided to us based on consent or contract.

8.6 Right to Object

You have the right to object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests by providing specific reasons related to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

8.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal and does not prevent us from continuing to process data on other legal grounds.

8.8 How to Exercise Your Rights

To exercise any of these privacy rights, please contact us at:

• Email: [email protected]
• Subject Line: "Data Privacy Rights Request"
• Include: Your full name, account username (if applicable), email address associated with your account, detailed description of your request, and proof of identity

We will respond to verified requests within fifteen (15) business days as required by Philippine law. If additional time is needed, we will notify you of the extension and the reasons for it.

8.9 Right to Lodge a Complaint

If you believe we have violated your privacy rights or applicable data protection laws, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Contact information: National Privacy Commission, 5th Floor, Philippine International Convention Center (PICC), Vicente Sotto Street, Pasay City 1307, Philippines. Email: [email protected]. However, we encourage you to contact us first so we can attempt to resolve your concerns directly.

9. International Data Transfers

Your personal information is primarily stored and processed within the Philippines. However, some of our service providers and business partners may be located outside the Philippines, which may result in your data being transferred to, stored, or processed in other countries.

9.1 Safeguards for International Transfers

When we transfer personal data outside the Philippines, we ensure appropriate safeguards are in place to protect your information, including:

• Transferring data only to countries that the National Privacy Commission has determined provide adequate data protection;
• Using standard contractual clauses approved by Philippine authorities;
• Ensuring service providers implement appropriate technical and organizational security measures;
• Conducting data protection impact assessments before transferring sensitive data;
• Obtaining your explicit consent for transfers where required by law.

9.2 Third-Party Service Providers

Some third-party service providers we use, such as cloud hosting platforms, payment processors, and analytics tools, may store data on servers located outside the Philippines. We carefully vet these providers and require them to comply with privacy standards equivalent to those mandated by Philippine law.

10. Changes to Privacy Policy

nustal reserves the right to modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will notify you through prominent notices on the Platform, via email, or through other appropriate communication channels.

10.1 Notification of Changes

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to stay informed about how we protect your personal information. For significant changes that materially affect your privacy rights, we will provide at least thirty (30) days' advance notice and may require you to affirmatively accept the revised Policy.

10.2 Continued Use After Changes

Your continued use of nustal services after the effective date of Privacy Policy changes constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must stop using the Platform and may request deletion of your account and personal data, subject to legal retention requirements.

10.3 Prior Versions

Previous versions of this Privacy Policy are archived and available upon request. Contact our Data Protection Officer to obtain historical versions.

Contact Information

If you have questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact:

Data Protection Officer

• Email: [email protected]
• Subject Line: "Privacy Inquiry"
• Response Time: We aim to respond to all privacy inquiries within 48 hours

General Customer Support

• Live Chat: Available 24/7 through the Platform
• Email: [email protected]

National Privacy Commission

For complaints about data protection violations:

• Website: www.privacy.gov.ph
• Email: [email protected]
• Address: 5th Floor, PICC, Vicente Sotto Street, Pasay City 1307, Philippines