Privacy Policy
How the ARMS Rewards app collects, uses, shares, keeps and deletes your personal data.
1. Who we are
The ARMS Rewards app is provided by [ARMS legal entity name and registered address] on behalf of [operator legal name], the licensed operator of the rewards programme ([licence reference]). [Roles — operator as personal information controller, ARMS as processor — COUNSEL to confirm].
Contact: rewards@arms.systems. Data protection officer: [name and contact, as required by the Philippine Data Privacy Act].
2. Who the app is for
The app is for adults of at least the legal age for gaming in the operator's market (21 in the Philippines). We do not knowingly collect personal data from anyone younger. An account that fails the age check is not verified.
3. What we collect, and why
| Data | Why we collect it | Required? |
|---|---|---|
| Mobile number | To send sign-in codes and to contact you about your membership. | Required |
| Name and date of birth | Identity verification, the age check, and the operator's anti-money-laundering obligations. | Required |
| Other identity details (for example address, place of birth, nationality, identity document type and number, nature of work, source of income) | The identity information the operator's regulator requires. Which fields are asked for is set by the operator. | As set by the operator |
| Photos of your identity document and a selfie | Identity verification by venue staff, kept as evidence that the check was done. Taken with your phone's camera; nothing is picked from your gallery. | [Optional — you can be verified in person at the desk instead. OWNER to confirm] |
| Venue cash account balance, desk transaction history and points history | To show you your account. Money moves only at the venue desk. | Required for the account view |
| Machine-tag taps (which machine, when) | To start a session that earns you points. | Optional |
| A random per-install identifier and the public half of a device key | To keep your sign-in secure and let you manage your devices. This is not a hardware identifier and not an advertising identifier. | Required |
| Your country, worked out on your phone | Only when the operator has a regional licensing restriction (none today). Only the country is sent — never your coordinates. | Only when a restriction applies |
4. What we do not collect
- No precise location, contacts, messages, or photos from your gallery.
- No advertising identifier and no biometric data. Fingerprint and face unlock happen on your phone; we only receive confirmation that it succeeded.
- No advertising, no tracking, and no analytics or crash-reporting software from other companies.
- Push notifications are switched off in the current app. [If they are switched on, a device push token is added to section 3.]
5. Legal bases
Under the Philippine Data Privacy Act of 2012 [and any other applicable law — COUNSEL] we rely on: the contract (running your membership); legal obligation (regulatory identification and anti-money-laundering record-keeping); and legitimate interests (security and fraud prevention).
6. Who we share it with
- The operator of your venue's programme [if the operator is not the controller — COUNSEL].
- Service providers acting on our instructions: cloud hosting, and SMS delivery of sign-in codes (which receives your mobile number only).
- The regulator and law enforcement, where the law requires.
We do not sell personal data.
7. Where it is stored
[Cloud region(s) — e.g. Microsoft Azure, East US 2 for the test environment; production region to confirm]. [Cross-border transfer safeguards — COUNSEL].
8. How long we keep it
- Identity and transaction records: at least 5 years after the membership ends, as the operator's regulator requires [COUNSEL to confirm the exact trigger and period].
- Sign-in codes and data exports: [short-lived — state the period].
- Everything else: deleted or anonymised when no longer needed.
9. Security
Data is encrypted in transit (HTTPS). Your session is held in your phone's secure storage and is not included in phone backups. Access to identity records is restricted by operator and every access is audited. [At-rest encryption of the database and document store — state only what the deployment actually does].
10. Your rights
You can ask for access to your data, correction, a copy (export), and deletion (subject to section 8). You can object to processing and complain to the National Privacy Commission. To exercise a right: [in the app, when available], at the venue desk, or by email to rewards@arms.systems.
11. Deleting your account
See Delete your ARMS Rewards account for the steps. When an account is deleted you are signed out everywhere, your PIN and registered devices are removed, unredeemed points expire, and your identity record is [erased / retained in restricted form until the end of the regulatory period — must match what the deletion process actually does].
12. Responsible gaming
Limits, breaks and self-exclusion are available in the programme. [Helpline name and number].
13. Changes to this policy
This policy is versioned. When it changes, members are asked to accept the new version in the app. Earlier versions are available on request.
14. Test builds
ARMS Rewards TEST is a pre-release build for named testers, connected to a test environment. [Whether test data is real personal data, and when it is purged — OWNER].
15. Contact us
Email rewards@arms.systems, or ask at your venue's desk.