Privacy Policy

Data Controller Identity

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the personal information controller responsible for your data is the operator of the nusstar platform ("nusstar," "we," "us," or "our"), accessible at nusstar.app.

nusstar has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance. You may contact the DPO at any time regarding matters covered by this Privacy Policy using the contact details provided in Section 15 of this document.

Categories of Personal Data We Collect

nusstar collects the following categories of personal data, grouped by function:

nusstar does not collect sensitive personal information as defined under RA 10173 (e.g., health information, political affiliations, religious beliefs) unless specifically required by applicable law or regulation for a defined compliance purpose.

How We Collect Your Personal Data

nusstar collects personal data through the following channels:

• Direct submission by you: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically when you access the nusstar platform, including via cookies and similar tracking technologies (see Section 7);
• Payment processors: Transaction reference data shared by GCash, Maya, BDO, BPI, and other payment intermediaries when you initiate deposits or withdrawals;
• Identity verification providers: Confirmation data returned by our KYC and facial verification technology partners during the account verification process;
• Regulatory authorities: Where permitted or required by Philippine law, data shared by PAGCOR or other government bodies in connection with regulatory compliance.

Legal Basis for Processing Personal Data

nusstar processes your personal data under the following lawful bases as provided under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and nusstar — including operating your account, processing wagers, and handling deposits and withdrawals;
• Legal obligation: Processing required to comply with applicable Philippine law — including PAGCOR regulatory requirements, Anti-Money Laundering Act obligations, and reporting requirements to the Anti-Money Laundering Council (AMLC);
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming compliance, and platform improvement, where such interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, promotional notifications, and non-essential cookies, where you have given specific, informed, and freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

How We Use Your Personal Data

nusstar uses the personal data it collects for the following specific purposes:

• Creating, maintaining, and operating your nusstar Account;
• Verifying your identity and age (21+ requirement) as mandated by PAGCOR;
• Processing deposits and withdrawals through GCash, Maya, BDO, BPI, and other supported Philippine payment methods;
• Detecting and preventing fraud, money laundering, account takeovers, and other prohibited activities;
• Monitoring gameplay patterns to fulfill responsible gaming obligations and identify indicators of problem gambling;
• Responding to your support requests, complaints, and regulatory inquiries;
• Sending transactional communications — including login alerts, withdrawal confirmations, and account security notifications — these cannot be opted out of as they are essential to account security;
• Sending promotional communications and bonus notifications where you have consented to receive them;
• Complying with legal and regulatory obligations including mandatory reporting to PAGCOR and the AMLC;
• Improving the nusstar platform through aggregated, anonymized analytics.

Data Sharing & Disclosure

nusstar does not sell your personal data. nusstar shares personal data only in the following limited circumstances:

• Payment processors: Transaction data shared with GCash, Maya, BDO, BPI, and other payment intermediaries solely for the purpose of processing your deposit or withdrawal. Each processor is bound by data processing agreements and applicable Philippine financial regulations;
• KYC and identity verification providers: Identity document and biometric data shared with accredited identity verification technology partners for the purpose of completing your KYC verification. These partners may not use your data for any purpose other than verification on behalf of nusstar;
• Regulatory authorities: Personal and gaming data disclosed to PAGCOR, the AMLC, the National Privacy Commission (NPC), or other Philippine government bodies where required by law, court order, or regulatory directive. nusstar will notify you of such disclosure where legally permitted to do so;
• Game content providers: Anonymized session data (not personally identifiable) may be shared with game providers for technical and fairness auditing purposes;
• Professional advisors: Legal, accounting, and audit professionals engaged by nusstar under confidentiality obligations, solely to the extent necessary for the provision of their professional services;
• Business transfers: In the event of a merger, acquisition, or sale of nusstar's business or assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations. You will be notified of any such transfer.

All third parties to whom nusstar discloses personal data are required by contract or applicable law to process that data only for the specific purpose disclosed and to maintain appropriate security measures.

Cookies & Tracking Technologies

nusstar uses cookies and similar tracking technologies on the nusstar.app website and mobile application. Cookies are small data files placed on your device that help us operate the platform effectively.

nusstar uses the following categories of cookies:

• Strictly necessary cookies: Required for the platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core functionality;
• Functional cookies: Store your preferences such as language settings, display options, and remembered login details. These are set only where you have not objected;
• Analytics cookies: Collect aggregated, anonymized data about how users interact with the platform to help us identify and fix issues and improve the user experience. nusstar uses analytics tools that process this data without identifying individual users;
• Marketing cookies: Used only where you have given explicit consent to receive personalized promotions and bonus notifications from nusstar. These are never shared with third-party advertisers.

You may manage cookie preferences through your browser settings or the cookie preference center within the nusstar platform. Withdrawing consent for non-essential cookies will not affect your ability to use core platform functions.

Data Retention

nusstar retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, subject to any longer retention period required by Philippine law.

• Active account data: Retained for the duration of your account and for a period of 5 years following account closure, in compliance with PAGCOR recordkeeping requirements and the Anti-Money Laundering Act;
• KYC and identity document data: Retained for 5 years from the date of verification or account closure (whichever is later), as required by AML regulations;
• Financial transaction records: Retained for 5 years from the date of each transaction, consistent with AML reporting obligations;
• Support communications: Retained for 3 years from the date of the last interaction, for dispute resolution purposes;
• Marketing consent records: Retained for the duration of the consent plus 3 years to demonstrate lawful processing.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with nusstar's data destruction procedures.

Data Security Measures

nusstar implements and maintains appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• AES-256 encryption for all personal data stored on nusstar systems;
• TLS 1.3 encryption for all data in transit between your device and nusstar servers;
• Role-based access controls limiting data access to authorized personnel on a strict need-to-know basis;
• Multi-factor authentication required for all staff access to systems holding personal data;
• Regular third-party security penetration testing and vulnerability assessments;
• Incident response procedures compliant with NPC notification requirements under RA 10173.

Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by nusstar:

• Right to be informed: You have the right to know what personal data nusstar holds about you, how it is collected, and how it is used — as described in this Privacy Policy;
• Right of access: You may request a copy of the personal data nusstar holds about you. nusstar will provide this within 30 days of a verified request;
• Right to correction: You may request that inaccurate or incomplete personal data be corrected. Account profile data may also be updated directly within your nusstar account settings;
• Right to erasure (right to be forgotten): You may request deletion of your personal data. Note that nusstar may be legally required to retain certain data (e.g., AML and PAGCOR records) for defined periods regardless of erasure requests — nusstar will inform you of any such constraints;
• Right to object: You may object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you have grounds relating to your particular situation;
• Right to data portability: You may request that your personal data be provided in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe nusstar has violated your data privacy rights.

To exercise any of the above rights, submit a written request to nusstar's Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request." nusstar will verify your identity before processing any request and will respond within the timeframes required by RA 10173.

Minors — Under-21 Policy

The nusstar platform is strictly restricted to persons who are 21 years of age or older, as required by PAGCOR regulations applicable to online gaming in the Philippines. nusstar does not knowingly collect personal data from persons under the age of 21.

nusstar enforces this restriction through mandatory age verification during registration, which requires submission of a valid Philippine government-issued ID. Where nusstar discovers or has reason to believe that personal data has been collected from a person under 21, nusstar will immediately suspend the associated account and delete all personal data relating to that individual to the extent permissible by law.

If you are a parent or guardian and believe your child (under 21) has created a nusstar account, please contact nusstar immediately at [email protected].

Cross-Border Data Transfers

nusstar's primary data processing infrastructure is located within or in compliance with Philippine data sovereignty requirements. In limited circumstances, personal data may be processed by service providers whose infrastructure is located outside the Philippines — specifically, certain cloud infrastructure and KYC technology providers.

Where personal data is transferred outside the Philippines, nusstar ensures that appropriate safeguards are in place in compliance with RA 10173, including contractual data processing agreements that require the recipient to maintain data protection standards equivalent to Philippine law, or transfers to jurisdictions recognized by the NPC as providing adequate protection.

Third-Party Links

The nusstar platform does not contain links to third-party websites. However, payment flows may redirect you to third-party payment provider interfaces (e.g., the GCash or Maya app) for transaction authorization. These third-party interfaces are governed by their own privacy policies. nusstar is not responsible for the data practices of payment providers once you have been redirected to their independent applications or websites.

nusstar recommends that you review the privacy policies of GCash (operated by Globe Fintech Innovations, Inc.) and Maya (operated by Maya Philippines, Inc.) to understand how those platforms handle your financial data during payment processing.

Amendments to This Privacy Policy

nusstar reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable Philippine law, or NPC guidance. The effective date of the current version is displayed at the top of this document.

Where amendments are material — meaning they significantly affect your rights or how we use your data — nusstar will notify registered Account holders via email at least 14 days before the amended policy takes effect. For minor or administrative amendments, nusstar may update the policy without advance notice.

Continued use of the nusstar platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated terms. If you do not agree to the amended policy, you must close your nusstar Account before the effective date.

Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or nusstar's data practices, please contact:

You also have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC is the independent government body responsible for enforcing RA 10173. Contact information for the NPC is publicly available through official Philippine government channels.