phphone Privacy Policy — Your Data, Your Rights

phphone ("phphone," "we," "us," "our") is committed to protecting the privacy and personal data of all persons who interact with the phphone platform, including visitors to phphone.vip, registered account holders, and former players whose data we retain pursuant to regulatory obligations.

This Privacy Policy applies to all personal data processed by phphone in connection with the operation of phphone.vip, including the casino games lobby, sports betting platform, bingo section, payment processing systems, customer support communications, and any other features or services offered through the phphone platform.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines (the "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Where phphone processes personal data of individuals in other jurisdictions, applicable data protection laws of those jurisdictions may also apply.

This Privacy Policy should be read in conjunction with phphone's Terms & Conditions, which govern the overall relationship between phphone and its registered players. In the event of any conflict between this Privacy Policy and the Terms & Conditions on matters relating to personal data, this Privacy Policy prevails.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, phphone acts as the Personal Information Controller (PIC) in respect of all personal data collected and processed through the phphone platform. As PIC, phphone is responsible for determining the purposes and means of processing your personal information.

phphone has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and with the Data Privacy Act. The DPO can be contacted through the details provided in Section 15 of this Policy.

phphone collects personal information in the following categories, depending on the nature of your interaction with the platform:

3.1 Information You Provide Directly

3.2 Information Collected Automatically

phphone uses your personal data for the following purposes. Each purpose is linked to a lawful processing basis described in Section 5:

• Account Management: To create and maintain your phphone account, authenticate your identity at login, and provide you access to phphone's games and features.
• Payment Processing: To facilitate deposits from and withdrawals to your GCash, Maya, BPI, BDO, or other registered payment methods. Financial data is shared with the relevant payment processors only to the extent necessary to complete the transaction.
• Identity Verification (KYC): To verify your identity and age as required by PAGCOR regulations and anti-money laundering obligations before processing withdrawals or in response to regulatory enquiries.
• Anti-Money Laundering (AML) Compliance: To monitor transactions and account activity for patterns indicative of money laundering, fraud, or other financial crimes, and to report suspicious activity to the Anti-Money Laundering Council (AMLC) as required by the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended).
• Responsible Gaming: To administer deposit limits, session controls, self-exclusion requests, and other responsible gaming measures you have configured, and to monitor account behaviour for indicators of problem gambling where required by our responsible gaming obligations.
• Customer Support: To respond to your queries, resolve disputes, process complaints, and provide technical assistance in connection with your phphone account.
• Platform Security: To detect, investigate, and prevent fraudulent account registrations, unauthorised login attempts, collusion, bonus abuse, and other security threats to the phphone platform.
• Legal and Regulatory Compliance: To comply with applicable Philippine laws, PAGCOR regulations, court orders, and requests from regulatory authorities including PAGCOR, the NPC, and AMLC.
• Service Improvement: To analyse aggregated, anonymised usage data to improve phphone's platform performance, mobile experience, and game offering for Filipino players.
• Communications: To send you transactional notifications (account events, deposit confirmations, withdrawal updates), service announcements, and — where you have given consent — promotional communications about phphone bonuses and offers.

Under the Data Privacy Act of 2012, phphone processes your personal data on the following legal bases:

phphone does not share your personal data with third parties except in the following circumstances, each of which is governed by appropriate data processing agreements or legal obligations:

6.1 Payment Processors

To process your GCash, Maya, BPI, BDO, and other payment method transactions, phphone shares the minimum necessary financial data with the relevant payment processors. These processors act as subcontractors to phphone and are contractually bound to handle your data only for transaction processing purposes and in compliance with applicable data protection laws.

6.2 Game Providers

phphone's platform integrates games from third-party providers including Pragmatic Play, JILI, PG Soft, and others. Game providers receive technical session data necessary to deliver the game experience (such as session tokens and bet data) but do not receive your personal identity information, GCash details, or KYC documents.

6.3 Regulatory Authorities

phphone is required by law to disclose player data to the following Philippine regulatory authorities where legally compelled to do so:

• PAGCOR — in connection with its supervisory and audit functions over phphone's online gaming operations;
• Anti-Money Laundering Council (AMLC) — in connection with suspicious transaction reports (STRs) and covered transaction reports (CTRs) required under the Anti-Money Laundering Act;
• National Privacy Commission (NPC) — in connection with its oversight of compliance with the Data Privacy Act of 2012;
• Law enforcement authorities — where required by a valid court order, subpoena, or lawful legal process under Philippine law.

6.4 Professional Advisers

phphone may share limited personal data with lawyers, auditors, accountants, and other professional advisers engaged by phphone where necessary for the purpose of obtaining professional advice and services, subject to obligations of professional confidentiality.

6.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of phphone's assets, your personal data may be transferred to the acquiring or successor entity. phphone will notify affected Players of any such transfer and will ensure that the successor entity is bound by privacy obligations at least equivalent to those set out in this Policy.

phphone uses cookies and similar tracking technologies on phphone.vip for the following purposes:

• Strictly Necessary Cookies: These cookies are essential to the operation of phphone.vip. They maintain your login session, store your language preferences, and enable core platform functions. These cookies cannot be disabled without impairing your ability to use phphone.
• Security Cookies: Used to detect fraudulent activity, maintain session integrity, and prevent cross-site request forgery attacks. These cookies are essential for platform security and cannot be disabled.
• Analytics Cookies: phphone uses anonymised analytics data to understand how Filipino players interact with the platform — which pages are most visited, which games are most played on mobile, and where technical issues occur. This data is aggregated and does not identify individual players.
• Preference Cookies: Store your platform preferences such as default game filters, display settings, and responsible gaming reminder configurations to improve your phphone experience across sessions.

You can manage cookie preferences through your browser settings. Disabling strictly necessary or security cookies will impair platform functionality. Please note that phphone.vip does not use third-party advertising cookies or allow ad networks to set cookies on phphone.vip.

phphone retains personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods driven by legal and regulatory obligations:

Upon expiry of the applicable retention period, phphone securely destroys or anonymises personal data in accordance with the NPC's guidelines on data disposal. Where data has been anonymised beyond re-identification, it may be retained indefinitely for statistical and analytics purposes.

phphone implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• Transport Encryption: All data transmitted between your device and phphone.vip is encrypted using TLS 1.2 or higher (HTTPS). Passwords are never transmitted or stored in plaintext — they are hashed using industry-standard one-way hashing algorithms.
• Data-at-Rest Encryption: Sensitive personal data including KYC documents and payment information is encrypted at rest in phphone's database infrastructure.
• Access Controls: Access to personal data within phphone is restricted on a need-to-know basis. Staff with access to player data undergo background screening and are bound by confidentiality obligations. Access is logged and regularly audited.
• Two-Factor Authentication: Player accounts support 2FA for login security, and phphone's internal administrative systems require 2FA for all staff with access to player data.
• Penetration Testing: phphone's platform infrastructure undergoes regular penetration testing and security audits by qualified third-party security specialists.
• Incident Response: phphone maintains a documented data breach response procedure compliant with NPC requirements, including mandatory notification to the NPC and affected players within 72 hours of becoming aware of a breach that poses a real risk to the rights and freedoms of data subjects.

While phphone takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You also have a role to play — maintaining the security of your phphone login credentials, enabling 2FA, and using secure networks (rather than public Wi-Fi) when accessing your phphone account significantly reduces your exposure to account-level security risks.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phphone. You can exercise any of these rights by contacting phphone's DPO using the details in Section 15:

To exercise any of the above rights, please contact phphone's Data Protection Officer at [email protected] with the subject line "Data Privacy Request — [Your Registered Email or Mobile Number]." phphone will verify your identity before processing any data rights request to ensure requests are fulfilled only on behalf of the legitimate account holder.

phphone verifies player age during the mandatory KYC process. Any account discovered to belong to a person under 21 years of age will be immediately and permanently closed. All KYC documents submitted by or on behalf of persons under 21 will be securely deleted after confirmation of the account closure.

If phphone becomes aware that it has inadvertently collected personal data from a person under 21 years of age prior to KYC verification, that data will be securely deleted as soon as the underage status is confirmed, and the matter will be reviewed in accordance with phphone's internal child protection procedures.

If you are a parent or guardian and believe that a person under your care has registered a phphone account, please contact phphone support immediately at [email protected] or via 24/7 live chat. phphone will prioritise such reports and will act on confirmed underage accounts within 24 hours of a verified report.

phphone's primary operations serve Filipino players. Some of phphone's technology infrastructure, game providers, and payment processors may process data in jurisdictions outside the Philippines, including in other parts of Asia and in cloud computing regions operated by major providers.

Where phphone transfers personal data outside the Philippines, such transfers are carried out in compliance with the Data Privacy Act of 2012 and the NPC's rules on cross-border data transfers. Specifically, phphone ensures that:

• Recipient organisations provide an equivalent level of data protection to that required under Philippine law, including through binding contractual clauses in data processing agreements;
• Cross-border transfers of sensitive personal information (such as KYC identity documents) are subject to heightened transfer safeguards;
• Third-party providers processing phphone player data outside the Philippines are assessed for data protection compliance before engagement and are bound by contractual obligations consistent with the DPA.

The phphone platform integrates third-party services including game software providers, payment processors, and customer communications tools. While phphone selects third-party service providers carefully and binds them to appropriate data protection obligations, phphone is not responsible for the independent privacy practices of third-party platforms.

In particular, please note the following:

• GCash and Maya: Your GCash and Maya accounts are operated by GXI (G-Xchange Inc.) and Voyager Innovations respectively. When you initiate a deposit or withdrawal via these platforms, you interact directly with those providers and their privacy policies apply to that interaction. phphone only receives transaction confirmation data necessary to credit or debit your phphone account.
• Bank Partners (BPI, BDO, Metrobank): Bank transfers involve your bank's own data processing. Each bank's privacy policy governs how your banking data is handled on the bank's side of the transaction.
• Game Providers: Third-party game providers deliver game software to phphone players through phphone's platform. Game providers process session data as sub-processors under phphone's instructions and are not permitted to use this data for their own marketing or profiling purposes.

phphone may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law (including NPC issuances), or changes in the phphone platform's features and services. Where changes to this Policy are material — meaning they could reasonably be expected to affect your rights or the manner in which your data is processed — phphone will provide advance notice of at least fourteen (14) days via a prominent notice on phphone.vip prior to the amended Policy taking effect.

For non-material amendments, such as corrections to typographical errors, clarifications that do not change the substance of existing provisions, or updates necessitated by minor regulatory changes, the revised Policy will take effect on the date it is published without prior notice.

The version number and effective date at the top of this Policy will always reflect the current version. Previous versions of the phphone Privacy Policy are archived and available on request by contacting phphone's DPO. Your continued use of phphone following the effective date of any updated Policy constitutes your acknowledgement of the updated terms.

For any questions about this Privacy Policy, to exercise your data rights under Section 10, to report a suspected privacy incident, or to submit a formal privacy complaint, please contact phphone's Data Protection Officer through the following channels:

• Email (preferred for formal privacy requests): [email protected] — Subject line: "Data Privacy Request" or "DPO Inquiry"
• Live Chat: Available 24/7 on phphone.vip — for urgent account security or data-related concerns
• Messenger: @phphone
• Viber: @phphone

phphone commits to acknowledging all formal privacy requests within seventy-two (72) hours and providing a substantive response within thirty (30) calendar days. Where a request requires additional time to process — for example, due to the volume or complexity of data involved — phphone will notify you of the extended timeline within the initial 30-day response window.

If you are not satisfied with phphone's response to your privacy request or complaint, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph. The NPC is the independent regulatory authority responsible for enforcing the Data Privacy Act of 2012.