nustar Privacy Policy

This Privacy Policy (the "Policy") describes how nustar (the "Company", "we", "us", or "our") collects, uses, stores, shares, and protects personal data relating to individuals who register or interact with the nustar Casino platform available at nustar.one and any associated services (collectively, the "Platform").

nustar is committed to protecting the privacy and personal information of all users — whether you're a registered member from Quezon City playing live baccarat, a player in Davao checking sports odds on your phone, or a visitor in Cebu browsing our game lobby before deciding to register. Wherever you are in the Philippines, your data deserves to be handled with care and in full compliance with applicable law.

This Policy applies to all personal data processed by nustar in connection with the Platform. It applies to Members, prospective registrants, visitors to the nustar website, and any individual who contacts nustar support. By using the Platform or registering an Account, you acknowledge that you have read and understood this Policy.

nustar is the data controller responsible for the personal data collected through the Platform. As the data controller, nustar determines the purposes for which personal data is processed and the means by which it is processed. nustar processes personal data in its capacity as a PAGCOR-regulated gaming platform operating in the Philippines.

nustar has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012. The DPO is responsible for overseeing nustar's data protection compliance programme and serves as the primary point of contact for data subjects wishing to exercise their rights under the DPA. Contact details for the DPO are provided in Section 14 of this Policy.

nustar collects personal data across several categories, depending on your interaction with the Platform:

nustar does not intentionally collect sensitive personal information (as defined under the Philippine DPA) beyond what is strictly necessary for age verification, identity verification, and compliance with PAGCOR's responsible gaming requirements. Special categories of data — such as health information relating to problem gambling disclosures — are processed solely for the purpose of providing appropriate responsible gaming support and are subject to additional access controls.

nustar collects personal data through the following channels:

• Direct collection: Information you provide when registering an Account, completing KYC verification, submitting a support request, or updating your Account profile.
• Automated collection: Technical and gaming activity data collected automatically as you navigate and interact with the nustar Platform, including through cookies, session logs, and analytics tools. See Section 7 for details on cookies.
• Payment processor data: Transaction confirmation data and partial payment credentials passed from GCash, PayMaya, or banking partners upon deposit or withdrawal processing.
• KYC and identity verification partners: Verification outcomes, fraud-scoring results, and identity match data from third-party KYC service providers engaged by nustar to meet PAGCOR regulatory obligations.
• Publicly available sources: Where required for anti-money laundering (AML) screening, nustar may cross-reference publicly available watchlists, sanctions databases, and politically exposed persons (PEP) registries.

nustar processes personal data only for specific, legitimate purposes. The following table sets out our primary processing purposes and the corresponding legal basis under the Philippine DPA:

Where nustar processes data on the basis of consent — such as for marketing communications — you may withdraw that consent at any time by updating your communication preferences in your nustar Account Settings or by contacting nustar support. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.

nustar does not sell, rent, or trade your personal data to third parties for their own independent commercial purposes. nustar shares personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency exchange partners — to process deposits, withdrawals, and transaction reconciliation. These providers process your financial data solely for payment execution.
• KYC and identity verification providers: Third-party services engaged by nustar to verify identity documents, confirm age, and conduct AML/PEP screening as required by PAGCOR and Philippine law.
• Game software providers: Licensed third-party studios that supply slot games, live dealer platforms, and sports betting engines to nustar. These providers may process game session data within their infrastructure as part of game delivery.
• Cloud and hosting infrastructure providers: Secure cloud hosting services used to operate the nustar Platform. All hosting providers are contractually required to implement appropriate data security measures.
• Customer support tooling providers: Software platforms used to manage nustar's live chat, ticketing, and communication systems.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where nustar is legally required to disclose data pursuant to regulatory requests, court orders, or statutory reporting obligations.

The nustar Platform uses cookies and similar technologies — including local storage, session tokens, and web beacons — to operate core Platform functionality, maintain login sessions, and collect analytics data on how users interact with the site.

• Essential cookies: Required for the Platform to function. These include authentication session tokens, security cookies, and load-balancing cookies. They cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to understand aggregate usage patterns on the nustar Platform — for example, which pages are most visited, average session duration, and device type distribution. Analytics data is processed in aggregate and is not used to identify individual users for marketing.
• Preference cookies: Store user interface preferences such as language settings and game lobby display options. These are optional and can be cleared via browser settings.

You can control and delete cookies through your browser settings. Note that disabling essential cookies will impair your ability to log in to your nustar Account and access Platform features. nustar does not use third-party advertising cookies or participate in cross-site behavioural tracking networks.

nustar retains personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law, whichever is longer. The following retention periods apply as general guidance:

• Account and identity data: Retained for the duration of the active Account relationship and for a minimum of five (5) years following account closure, as required by PAGCOR record-keeping obligations and Philippine tax law.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLC and Bureau of Internal Revenue (BIR) requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of last verification or account closure. Extended retention may apply where regulatory review is pending.
• Customer support communications: Retained for two (2) years from the date of the last interaction, to support quality assurance and dispute resolution.
• Gaming activity logs: Retained for five (5) years from the date of each recorded session, for PAGCOR compliance and responsible gaming audit purposes.
• Technical and access logs: Retained for a maximum of twelve (12) months, unless longer retention is required for an active security investigation.

Where a Member requests account deletion and there are no outstanding legal, regulatory, or dispute-related grounds requiring retention, nustar will anonymise or delete personal data within 30 calendar days of confirming the deletion request, subject to the minimum legal retention periods above.

nustar implements a layered security architecture designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. Key technical and organisational measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and nustar servers.
• Encryption at rest for stored sensitive data including KYC documents and financial account identifiers.
• Role-based access controls (RBAC) restricting internal access to personal data to authorised personnel with a legitimate need-to-know basis.
• Two-factor authentication (2FA) available to all Members and enforced for internal administrative access.
• Intrusion detection systems (IDS) and continuous security monitoring across nustar's hosting infrastructure.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Staff data protection training conducted regularly for all personnel with access to personal data.

Under the Philippine Data Privacy Act of 2012, nustar Members have the following rights in relation to their personal data. nustar will respond to verified rights requests within 30 calendar days:

The nustar Platform is strictly for individuals who are 21 years of age or older, in accordance with PAGCOR regulations governing online casino gaming in the Philippines. nustar does not knowingly collect personal data from individuals under the age of 21.

Age verification (KYC) is mandatory for all Members before withdrawal privileges are activated and may be requested at registration or at any point during the account lifecycle. If nustar discovers or reasonably suspects that a person under 21 has registered an Account, that Account will be immediately suspended, any balance will be held pending investigation, and the matter may be reported to PAGCOR in accordance with regulatory requirements.

If a parent or guardian believes their child under 21 has accessed the nustar Platform, they should contact nustar support immediately at the address provided in Section 14.

Some of nustar's service providers — including cloud hosting infrastructure, game software suppliers, and KYC verification platforms — may process personal data outside the Republic of the Philippines. Where personal data is transferred internationally, nustar ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements with the receiving party that impose data protection obligations equivalent to those required under the Philippine DPA;
• Transfer to recipients in jurisdictions that the National Privacy Commission has recognised as providing an adequate level of data protection;
• Standard contractual clauses approved or recognised by the NPC, where applicable.

nustar does not transfer personal data internationally for purposes other than those described in this Policy and the applicable Data Processing Agreements with service providers.

nustar may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services offered on the Platform. When material changes are made, nustar will notify registered Members via email or on-platform notification at least seven (7) days prior to the updated Policy taking effect.

The "Last Updated" date at the top of this Policy will be revised each time a change is made. Continued use of the nustar Platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you should contact nustar to close your Account before the effective date.

For all privacy-related inquiries, data subject rights requests, or concerns about nustar's handling of your personal data, please contact nustar's Data Protection Officer through the following channels:

nustar aims to respond to all privacy-related correspondence within 5 business days for general inquiries and within 30 calendar days for formal data subject rights requests. For complex requests, nustar may extend the response period by an additional 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with nustar's response to your privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines, which is the independent regulatory body responsible for administering the Data Privacy Act of 2012.