Privacy Policy
How 3600 Handles Your Data

3600 operates as an online gaming platform serving players in the Philippines. As a data controller, 3600 is responsible for the personal information it collects and processes in connection with the provision of its services. This Policy governs all personal data processing activities carried out by 3600, whether through the 3600.live website, any associated mobile-optimized interface, or through direct communications with our support team.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines. Where applicable, 3600 also observes the data protection principles set out by the Philippine Amusement and Gaming Corporation (PAGCOR) in connection with its regulatory oversight of online gaming operators.

This Policy applies to personal information collected from players located in the Philippines, including those in Metro Manila, Cebu, Davao, Quezon City, Makati, and all other regions. If you access the Platform from outside the Philippines, your data may still be processed in accordance with this Policy and Philippine law.

3600 collects personal information that is necessary for the operation of the Platform, the provision of gaming services, and compliance with applicable legal and regulatory obligations. The categories of personal data we collect include, but are not limited to, the following:

• Full legal name as it appears on a government-issued identification document
• Date of birth and age verification data
• Residential address (barangay, city/municipality, province, region)
• Email address and mobile number
• Government-issued ID type and number (e.g., PhilSys, passport, UMID, SSS, driver's license)
• Selfie or photograph submitted for identity verification purposes

• Payment method details (e.g., GCash mobile number, PayMaya account reference, bank account name and number for BPI, BDO, Metrobank, or other participating banks)
• Transaction history, including deposit amounts, withdrawal requests, and bonus credits
• Source of funds documentation where required for AML compliance

• Game session logs, including games played, wager amounts, outcomes, and session duration
• Responsible gaming settings and self-exclusion records
• Bonus and promotion usage history

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Cookies, session tokens, and similar tracking technologies
• Login timestamps and access logs

• Records of communications with 3600 customer support, including live chat transcripts, email correspondence, and support ticket history
• Feedback, survey responses, and voluntary information submitted through the Platform

3600 collects personal information through the following means:

• Direct submission — Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, or contacting our support team.
• Automated collection — Technical data collected automatically when you access the Platform, including through cookies, server logs, and analytics tools.
• Third-party sources — Identity verification data from KYC service providers; transaction data from payment processors such as GCash, PayMaya, and partner banks; fraud detection signals from security service providers.
• Regulatory sources — Information received from PAGCOR or other regulatory bodies in connection with compliance obligations, including self-exclusion registers.

3600 processes personal data only for specific, legitimate purposes. The table below summarizes the primary purposes for which your data is used and the corresponding data categories involved.

3600 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by applicable law.

Under the Data Privacy Act of 2012, 3600 processes personal information on the following legal bases:

• Contractual necessity — Processing required to fulfill our obligations to you under the Terms & Conditions, including account management, game provision, and financial transactions.
• Legal obligation — Processing required to comply with applicable laws and regulations, including PAGCOR licensing requirements, AML obligations under the Anti-Money Laundering Act (AMLA), and tax reporting requirements.
• Legitimate interests — Processing necessary for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights and freedoms.
• Consent — Processing for marketing communications and non-essential cookies, where you have provided explicit, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

3600 does not sell, rent, or trade your personal information to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC and identity verification providers — Third-party services engaged to verify your identity and age in compliance with regulatory requirements.
• Payment processors — GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers involved in processing your deposits and withdrawals.
• Game content providers — Licensed game studios and live dealer operators whose games are made available through the 3600 platform.
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities, where disclosure is required by law or court order.
• IT and security service providers — Cloud hosting, cybersecurity, and fraud detection vendors engaged to support the secure operation of the Platform.

3600 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with 3600's data disposal procedures. Where data is anonymized, it may be retained indefinitely for statistical and analytical purposes.

3600 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Platform
• Encryption of sensitive data at rest, including financial information and identity documents
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Regular security assessments, penetration testing, and vulnerability scanning
• Multi-factor authentication for internal systems and administrative access
• Incident response procedures for detecting, reporting, and managing personal data breaches

While 3600 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the security of your account credentials and for notifying 3600 immediately if you suspect any unauthorized access to your account.

3600 uses cookies and similar tracking technologies to operate and improve the Platform, personalize your experience, and analyze usage patterns. Cookies are small text files stored on your device when you visit the Platform.

• Strictly necessary cookies — Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled.
• Functional cookies — Remember your preferences such as language settings and game display options to improve your experience.
• Analytics cookies — Collect anonymized data about how players use the Platform to help us improve performance and content. Used with your consent.
• Security and fraud detection cookies — Help identify and prevent fraudulent activity and unauthorized access attempts.

You can manage non-essential cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a new cookie is set. Please note that disabling certain cookies may affect the functionality of the Platform. Strictly necessary cookies cannot be disabled as they are essential to the operation of the service.

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal information held by 3600. You may exercise any of these rights by contacting our Data Protection Officer (DPO) using the details provided in Section 13.

3600 will respond to all verified data subject requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notice to you. We may require proof of identity before processing any request to protect against unauthorized access to your data.

If you are a parent or guardian and believe that your child has registered on the Platform or provided personal information to 3600, please contact our Data Protection Officer immediately using the contact details in Section 13. We will investigate and take appropriate action without undue delay.

3600 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The most current version of this Policy will always be available at 3600.live/privacy-policy, and the effective date at the top of the Policy will be updated accordingly.

Where changes to this Policy are material — meaning they significantly affect your rights or the way we process your personal data — 3600 will notify registered players via the email address or mobile number associated with their account, or by posting a prominent notice on the Platform, at least fourteen (14) days before the changes take effect.

Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Policy, you should cease using the Platform and may request account closure by contacting our support team.

3600 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to this Policy or the processing of your personal data, please contact the DPO using the details below.

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe that 3600 has violated your data privacy rights. Information on how to file a complaint with the NPC is available through official Philippine government channels.