phll Privacy Policy

1. Overview and Scope

This Privacy Policy ("Policy") describes how phll ("phll", "we", "us", "our"), the operator of the online gaming platform at phll.app, collects, processes, stores, and protects the personal information of users ("Player", "User", "you") who access or use the phll platform, including its website, mobile interface, games, and related services.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. By registering for a phll account or using any phll service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy applies to all personal data collected through the phll platform, regardless of whether you access phll via a desktop browser, mobile browser, or any other interface. It does not apply to third-party websites or services that may be linked from the phll platform.

2. Personal Data We Collect

phll collects the following categories of personal data from players and prospective players:

2.1 Identity and Contact Data

• Full legal name as it appears on a government-issued ID
• Date of birth and age verification documentation
• Residential address (including barangay, city, province, and postal code)
• Email address and mobile phone number
• Government-issued identification numbers (e.g., passport number, driver's licence number, SSS/UMID number)
• Nationality and country of residence

2.2 Financial Data

• GCash or PayMaya account details (mobile number linked to the e-wallet)
• Bank account details for bank transfer transactions (account name, account number, bank name)
• Debit card details (card number, expiry date – stored in tokenised form only)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment methods used

2.3 Gaming and Account Data

• phll username and account ID
• Game history, including games played, wager amounts, wins, losses, and session durations
• Bonus and promotion history
• Responsible gaming settings and self-exclusion records
• Customer support interaction records

2.4 Technical and Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Pages visited, features used, and time spent on the phll platform
• Login timestamps and session data
• Cookie identifiers and similar tracking data (see Section 9)

3. How We Collect Your Data

phll collects personal data through the following means:

• Direct collection: Information you provide when registering for a phll account, completing identity verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access and use the phll platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance service providers; payment data from payment processors (GCash, PayMaya, banks).
• Regulatory sources: Data received from PAGCOR or other regulatory bodies in connection with licensing, compliance, or investigation requirements.

4. How We Use Your Personal Data

phll uses the personal data it collects for the following purposes:

phll will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

5. Legal Basis for Processing

phll processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and phll, including account registration, game provision, and payment processing.
• Legal obligation: Processing required to comply with applicable laws and regulations, including AML obligations, KYC requirements, and PAGCOR regulatory reporting.
• Legitimate interests: Processing necessary for phll's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, including for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Data Sharing and Disclosure

phll does not sell your personal data to third parties. phll may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya/Maya, and Philippine banking partners, for the purpose of processing deposits and withdrawals.
• Identity verification providers: Third-party KYC and AML screening service providers engaged to verify player identities and screen against sanctions and watchlists.
• Game providers: Licensed game software providers whose games are available on the phll platform, to the extent necessary to deliver the gaming service.
• Regulatory authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities, where required by law or regulatory obligation.
• IT and security service providers: Cloud hosting, cybersecurity, and platform infrastructure providers engaged by phll to operate and secure the platform.
• Professional advisers: Legal, accounting, and auditing firms engaged by phll, subject to professional confidentiality obligations.

7. Data Retention

phll retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your phll account and for a minimum of five (5) years after account closure, in compliance with AML record-keeping requirements under Philippine law.
• Financial transaction data: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act.
• Gaming history: Retained for a minimum of three (3) years from the date of each game session.
• Customer support records: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of consent.
• Technical and usage data: Retained for up to twelve (12) months from collection, unless required for longer for security or fraud investigation purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with phll's data disposal procedures.

8. Security Measures

phll implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phll platform.
• Encryption at rest for sensitive personal and financial data stored on phll's servers.
• Payment card tokenisation – debit card details are never stored in plain text; only secure tokens are retained.
• Multi-factor authentication (MFA) options for player accounts and mandatory MFA for all phll administrative access.
• Regular penetration testing and security audits conducted by independent cybersecurity specialists.
• Role-based access controls ensuring that phll staff can only access personal data necessary for their specific job function.
• Incident response procedures including notification protocols in the event of a personal data breach, in accordance with NPC requirements.

9. Cookies and Tracking Technologies

phll uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit the phll website. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences, such as language settings and responsible gaming limits you have set, to provide a more personalised experience.
• Analytics cookies: Collect anonymised data about how players use the phll platform, helping phll understand which features are most used and where improvements can be made. No personally identifiable information is collected through analytics cookies.
• Marketing cookies: Used only with your consent to deliver relevant promotional content about phll offers. You may withdraw consent for marketing cookies at any time through your account settings or browser settings.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect the functionality of the phll platform. For full details, refer to phll's Cookie Policy, which forms part of this Privacy Policy.

10. Your Data Privacy Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phll:

To exercise any of these rights, please contact phll's Data Protection Officer using the contact details in Section 13. phll will respond to all verified requests within thirty (30) days. phll may request proof of identity before processing a data subject request.

If you believe phll has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.

11. Minors and Age Restriction

If you are a parent or guardian and believe that a minor has registered on the phll platform or provided personal data to phll, please contact the support team immediately at the contact details provided in Section 13. phll takes underage gambling extremely seriously and will act promptly on all such reports.

12. Changes to This Privacy Policy

phll reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or phll's data processing practices. When material changes are made, phll will notify registered players via email and/or a prominent notice on the platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the phll platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the updated Policy, you must cease using the platform and may request account closure.

13. Contact the Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or phll's data processing practices, please contact phll's Data Protection Officer: