Privacy Policy —
How nustra Protects
Your Personal Data

nustra ("we," "us," "our," or the "Company") is committed to protecting the privacy and personal data of all individuals who interact with our platform. This Privacy Policy has been prepared in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) of the Philippines, and its Implementing Rules and Regulations, as well as the applicable data privacy guidelines issued by the National Privacy Commission (NPC).

This Privacy Policy governs the collection, use, storage, sharing, and protection of your personal data in connection with your use of the nustra website at nustra.pro, our mobile applications (where available), and all services provided under the nustra brand — including online casino games, live dealer tables, sports betting, e-sabong, bingo, slots, and all account management functions.

nustra operates as a PAGCOR-licensed online gaming platform. As a licensed operator, we are subject to PAGCOR's data governance requirements in addition to the DPA. Where PAGCOR guidelines impose stricter data protection obligations than the general DPA framework, we apply the stricter standard.

nustra collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is processed. The categories of personal data we collect are outlined below:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify the 21+ age requirement)
• Gender
• Nationality and country of residence
• Residential address (including barangay, city, province, and ZIP code for Philippine players)
• Government-issued ID type and ID number (e.g., PhilSys National ID, SSS ID, UMID, passport, driver's license)

2.2 Contact Data

• Email address
• Mobile number (Philippine mobile numbers in the format +63 9XX XXX XXXX)

2.3 Financial & Payment Data

• GCash or Maya registered mobile number and account name
• Bank account details (account name, account number, bank name) for BPI, BDO, UnionBank, or Metrobank transfers
• Cryptocurrency wallet address (for USDT TRC20 transactions)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used
• Source of funds documentation where required by PAGCOR AML guidelines

2.4 Gaming Activity Data

• Game play history, bet records, wager amounts, and outcomes
• Bonus claims, wagering requirement progress, and promotion participation records
• Session duration, login timestamps, and activity logs
• Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status)

2.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Cookie identifiers and session tokens
• Referring URL and pages visited within nustra.pro

2.6 Communications Data

• Records of customer support conversations (live chat transcripts, email correspondence)
• Survey responses and feedback submitted through the platform
• Dispute and complaint records

nustra collects your personal data through the following channels and methods:

nustra processes your personal data only for specific, legitimate, and clearly defined purposes. We do not process your data in any manner incompatible with these stated purposes. The primary purposes for which nustra processes personal data are:

• Account Creation & Management: To register your nustra account, verify your identity, and manage your account settings and preferences throughout your relationship with us.
• Age Verification: To confirm that you meet the mandatory 21+ age requirement under PAGCOR licensing rules before you are permitted to access real-money gaming features.
• KYC & AML Compliance: To fulfill our legal obligations under PAGCOR licensing requirements and Republic Act No. 9160 (Anti-Money Laundering Act), including ongoing transaction monitoring and suspicious activity reporting to the AMLC.
• Payment Processing: To facilitate deposits and withdrawals via GCash, Maya, BPI, BDO, UnionBank, Coins.ph, 7-Eleven, and USDT TRC20.
• Gaming Services Delivery: To provide access to nustra's casino games, sports betting markets, e-sabong, bingo, and slot games, and to record your gaming activity accurately for account integrity purposes.
• Bonus & Promotion Administration: To assess your eligibility for promotional offers, track wagering requirement progress, and prevent bonus abuse.
• Responsible Gaming: To monitor gaming patterns for signs of problem gambling behavior, enforce player-requested self-exclusion and limit settings, and comply with PAGCOR responsible gaming guidelines.
• Customer Support: To respond to your queries, resolve disputes, and maintain records of our communications with you.
• Platform Security & Fraud Prevention: To detect and prevent unauthorized access, fraudulent activity, and platform abuse.
• Legal Compliance & Regulatory Reporting: To meet our obligations as a PAGCOR-licensed operator, including mandatory reporting to PAGCOR, the AMLC, and other competent Philippine government authorities.
• Marketing Communications (with consent): To send you promotional offers, platform updates, and gaming news where you have provided explicit consent. You may withdraw this consent at any time through your account settings.

Under the Data Privacy Act of 2012, nustra processes your personal data on the following lawful bases:

nustra does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your personal data only where necessary, and only with the following categories of recipients, each of whom is bound by contractual data protection obligations or applicable law:

6.1 Regulatory & Government Authorities

nustra is legally required to share certain data with Philippine government bodies, including:

• PAGCOR — as our licensing authority, PAGCOR may request player account data, transaction records, and gaming activity logs as part of its regulatory oversight function.
• Anti-Money Laundering Council (AMLC) — we are legally required to file covered transaction reports (CTRs) and suspicious transaction reports (STRs) under the AMLA.
• National Privacy Commission (NPC) — in the event of a personal data breach, we are required to notify the NPC within 72 hours of discovery.
• Law enforcement agencies — where compelled by a valid court order, subpoena, or lawful request from a Philippine law enforcement authority.

6.2 Service Providers & Data Processors

nustra engages carefully selected third-party service providers who process personal data on our behalf and under our documented instructions:

• Payment processors: GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, UnionBank, and other payment gateway operators — for deposit and withdrawal processing.
• KYC verification providers: Identity document verification platforms used to authenticate government-issued IDs and confirm player identity.
• Cloud infrastructure providers: Secure cloud hosting providers used to store platform data and ensure platform availability.
• Customer support platforms: Live chat and ticketing system providers used to manage player support interactions.
• Fraud detection and cybersecurity providers: Tools used to detect unauthorized access, bot activity, and fraudulent transactions.

6.3 Game Content Providers

Where nustra integrates third-party game content (e.g., live dealer studios, slot providers), limited technical data such as your session token and game activity may be shared with the content provider solely for the purpose of delivering the game experience. These providers do not receive your full identity data.

nustra retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymized such that it can no longer be linked to your identity. Anonymized and aggregated statistical data may be retained indefinitely for platform analytics purposes.

nustra uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to analyze platform usage. The following types of cookies are used on nustra.pro:

8.1 Strictly Necessary Cookies

These cookies are essential for the nustra platform to operate and cannot be disabled. They include session authentication tokens, security cookies, and load-balancing cookies. No personal data is collected beyond what is strictly required for platform functionality.

8.2 Functional Cookies

These cookies remember your preferences and settings — such as your chosen language, display preferences, and responsible gaming limit configurations — so you do not have to re-enter them on each visit. These cookies can be disabled, but doing so may affect platform functionality.

8.3 Analytics Cookies

With your consent, nustra uses analytics cookies to understand how players interact with the platform — which game categories are most popular, how players navigate between sections, and where technical errors occur. This data is used in aggregate form to improve the nustra platform experience. You may opt out of analytics cookies at any time through the cookie preferences panel.

8.4 Managing Your Cookie Preferences

You can manage your cookie preferences at any time by accessing the cookie settings panel available in the footer of the nustra platform. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will prevent you from accessing nustra's gaming features.

nustra implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and nustra.pro is encrypted using TLS 1.2 / TLS 1.3 protocols. We enforce HTTPS across the entire platform.
• Encryption at Rest: Sensitive personal data stored in nustra's databases — including KYC documents, financial data, and account credentials — is encrypted at rest using industry-standard encryption algorithms.
• Password Security: Player passwords are stored as salted cryptographic hashes. nustra never stores passwords in plaintext and cannot retrieve your password — only reset it.
• Two-Factor Authentication (2FA): nustra offers 2FA for all registered accounts. Players are strongly encouraged to enable 2FA to add an additional layer of protection.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. nustra staff access to player data is logged and audited regularly.
• Penetration Testing & Vulnerability Assessments: nustra conducts regular security audits and penetration testing to identify and remediate potential vulnerabilities before they can be exploited.
• Data Breach Response: nustra maintains a formal data breach response procedure. In the event of a personal data breach, we will notify the National Privacy Commission (NPC) within 72 hours of discovery, and affected players will be notified without undue delay where the breach poses a high risk to their rights and freedoms.

As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights with respect to your personal data held by nustra. To exercise any of these rights, contact our Data Protection Officer at [email protected] with a clear description of your request.

Details of Your Rights

• Right to Be Informed: You have the right to be informed that your personal data is being collected and processed, and of the purposes and legal basis for that processing — as described in this Privacy Policy.
• Right to Access: You may request a copy of the personal data nustra holds about you, along with information about how it is being used, at any time.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure (Right to be Forgotten): You may request that nustra delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under PAGCOR and AMLA requirements.
• Right to Object: You may object to the processing of your personal data where processing is based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: Where processing is carried out by automated means and based on your consent or a contract, you may request that your data be provided to you in a structured, commonly used, machine-readable format.
• Right to File a Complaint: If you believe nustra has violated your data privacy rights, you have the right to file a complaint with the National Privacy Commission (NPC) through their official channels.
• Right to Withdraw Consent: Where processing is based solely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

nustra will respond to all verifiable data subject requests within 30 calendar days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

nustra's platform is strictly intended for individuals who are 21 years of age or older, in compliance with PAGCOR's licensing requirements for online gaming in the Philippines. nustra does not knowingly collect, process, or store personal data from individuals below the age of 21.

During the registration process, all applicants are required to confirm their date of birth and submit a valid government-issued ID to verify their age. Any account found to belong to a person under 21 years of age will be immediately suspended and all funds held in that account will be dealt with in accordance with PAGCOR guidelines, which may include forfeiture of winnings obtained during underage play.

If nustra becomes aware, at any point after account creation, that a registered player is under 21 years of age, we will immediately close the account, delete the personal data associated with it to the extent permitted by our legal retention obligations, and report the incident to PAGCOR as required.

nustra's primary data processing infrastructure is located within the Philippines. However, certain third-party service providers — including cloud infrastructure providers, KYC verification partners, and game content providers — may be located outside the Philippines and may process your personal data in their respective jurisdictions.

Where your personal data is transferred outside the Philippines, nustra ensures that appropriate safeguards are in place in accordance with the Data Privacy Act of 2012 and NPC guidelines on cross-border data flows. These safeguards include:

• Contractual data processing agreements incorporating the NPC's standard data protection clauses
• Transfers only to jurisdictions or entities that the NPC has determined provide an adequate level of data protection
• Binding corporate rules where applicable for transfers within a corporate group

By creating an account on nustra.pro and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to third-party service providers located outside the Philippines, subject to the safeguards described above.

nustra reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidelines, or PAGCOR regulatory requirements. The revised Privacy Policy will be posted on nustra.pro with an updated effective date shown at the top of the document.

Where changes are material — meaning they significantly affect your rights or the way we process your personal data — nustra will provide advance notice via email to your registered address or through a prominent notice on the platform at least 14 calendar days before the changes take effect. Your continued use of the nustra platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically. The current version is always accessible at nustra.pro/privacy-policy. If you do not agree with any changes to this Privacy Policy, you should stop using the nustra platform and may request account closure by contacting our Data Protection Officer.

If you have any questions, concerns, or requests relating to this Privacy Policy or nustra's data protection practices, please contact our designated Data Protection Officer (DPO):

Please include the following in your message when contacting the DPO: your full name as registered on nustra, your registered email address, a clear description of your request or concern, and (for data access or erasure requests) a copy of a valid government-issued ID for identity verification purposes.