phll Privacy Policy

1 About This Privacy Policy

1.1 This Privacy Policy ("Policy") is issued by phll ("phll," "we," "us," "the Platform") and applies to all personal information collected from individuals who access or use the phll.asia website, create a phll Account, make deposits or withdrawals, place wagers, or interact with phll customer support.

1.2 This Policy should be read together with phll's Terms and Conditions and Responsible Gaming Policy, all of which form part of the agreement between you and phll.

1.3 By registering an Account on phll.asia or by continuing to use the Platform after this Policy has been updated, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal information as described herein.

1.4 If you do not agree to the terms of this Policy, you must not register an Account or continue to use the phll Platform.

2 Data Controller Identity

2.1 For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, phll is the Personal Information Controller in respect of all personal data collected and processed through the phll.asia platform.

2.2 phll has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with RA 10173. Contact details for the phll DPO are set out in Section 14 of this Policy.

2.3 Where phll engages third-party service providers who process personal data on phll's behalf (such as payment processors, KYC verification services, and cloud infrastructure providers), those parties act as Personal Information Processors under written data processing agreements that impose equivalent privacy and security obligations.

3 Categories of Personal Data We Collect

3.1 phll collects the following categories of personal information from Players and prospective Players:

3.2 phll does not collect sensitive personal information as defined under Section 3(l) of RA 10173 (including race, religion, health data, sexual orientation, or biometric data) except where strictly required for age and identity verification purposes under applicable PAGCOR regulations, and only with the data subject's explicit consent.

4 How We Collect Your Personal Data

4.1 phll collects personal information through the following channels:

• Direct submission: Information you provide when registering your Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access phll.asia, including session data, IP address, device identifiers, and browser characteristics, collected via server logs, cookies, and similar tracking technologies.
• Third-party verification services: Identity and age verification data received from PAGCOR-approved KYC service providers in the course of verifying your Account.
• Payment processors: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and other authorized payment channels when you deposit or withdraw funds on phll.
• Fraud and AML screening: Risk signals and screening results from AMLC-authorized financial intelligence tools used to comply with the Anti-Money Laundering Act.

5 Legal Basis and Purposes of Processing

5.1 phll processes your personal data on the following legal bases under RA 10173 and applicable PAGCOR regulations:

5.2 Where phll relies on your consent as the legal basis for processing (specifically for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. You may update your marketing preferences through your phll Account settings or by contacting support.

6 Data Sharing and Disclosure

6.1 phll does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the following limited circumstances:

• PAGCOR and regulatory bodies: phll is legally required to share certain player data with PAGCOR and, where mandated, with the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government agencies with lawful authority to request such data.
• KYC and identity verification providers: Personal identity documents and verification data are shared with PAGCOR-authorized KYC service providers for the sole purpose of verifying your age and identity. These providers are contractually bound to process data only for this purpose.
• Payment processors: Transaction data is shared with GCash, PayMaya, BPI, BDO, Metrobank, and other payment channel operators as necessary to process your deposits and withdrawals.
• Cloud and infrastructure providers: Technical data and account data is stored on secure servers operated by reputable cloud infrastructure providers under data processing agreements that meet RA 10173 requirements.
• Legal proceedings: phll may disclose personal data where required by a valid court order, subpoena, or other legally compelled disclosure under Philippine law.

6.2 In all cases of third-party data sharing, phll requires that the recipient processes your personal data only for the specific purpose for which it was shared, maintains appropriate security measures, and does not further disclose or transfer the data without phll's prior written authorization.

7 International Data Transfers

7.1 phll's primary data processing infrastructure is located within the Philippines. Where it is necessary to transfer personal data to service providers located outside the Philippines — for example, to global cloud infrastructure providers or international game software licensors — phll ensures that such transfers are conducted in compliance with Section 21 of RA 10173, including the requirement that the receiving party provides an adequate level of data protection.

7.2 International data transfers by phll are governed by standard contractual clauses or equivalent data transfer mechanisms approved by the National Privacy Commission. You may request further information about the specific safeguards applicable to any international transfer of your data by contacting the phll DPO.

8 Data Retention

8.1 phll retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years after Account closure, as required by PAGCOR licensing conditions and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by BSP and AMLC regulations.
• Gaming activity data: Retained for a minimum of three (3) years from the date of the gaming session, for regulatory audit and dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical and session data: Retained for twelve (12) months from the date of collection, except where required for an ongoing fraud investigation or legal proceeding.
• Marketing preference data: Retained until you withdraw consent or request erasure, subject to regulatory retention requirements.

8.2 At the expiry of the applicable retention period, personal data will be securely deleted or anonymized such that it can no longer be linked to an identifiable individual.

9 Security Measures

9.1 phll implements appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, destruction, or accidental loss. These measures include:

• Encryption: All data transmitted between your browser and phll.asia is encrypted using 256-bit SSL/TLS protocols. Passwords are stored as salted cryptographic hashes — never in plain text.
• Access controls: Access to personal data by phll staff is restricted on a need-to-know basis. All staff with access to player data undergo background screening and data privacy training.
• Two-factor authentication: phll strongly recommends — and supports — the use of 2FA on all Player Accounts as an additional layer of login security.
• Intrusion detection: phll's platform is monitored continuously by automated security systems designed to detect and respond to unauthorized access attempts, DDoS attacks, and other security threats.
• Data breach response: phll maintains a documented data breach response procedure. In the event of a personal data breach, phll will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected Players without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

9.2 Notwithstanding the foregoing, no data transmission over the internet or electronic storage system can be guaranteed to be completely secure. phll cannot warrant absolute security of your personal data, but commits to implementing industry-standard safeguards and to responding promptly and transparently to any security incidents.

10 Cookies and Tracking Technologies

10.1 phll uses cookies and similar tracking technologies on phll.asia for the following purposes:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management, login authentication, and security token validation. These cookies cannot be disabled without impairing Platform functionality.
• Performance cookies: Used to collect anonymized data on how players use phll.asia (e.g., pages visited, time on page, error messages) to help phll improve the Platform. No personally identifiable information is collected through performance cookies.
• Functionality cookies: Used to remember your preferences (e.g., language selection, display settings) so that you do not need to re-enter them on each visit.
• Analytics cookies: Used to understand aggregate usage patterns across the Platform. Analytics data is processed in anonymized or pseudonymized form.

10.2 You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the phll Platform.

10.3 phll does not use cross-site tracking cookies or third-party advertising cookies that would result in your personal data being shared with advertisers.

11 Your Rights as a Data Subject

11.1 Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by phll:

• Right to be Informed: The right to be informed of how your personal data is collected, used, stored, and disclosed — which is the primary purpose of this Policy.
• Right of Access: The right to obtain a copy of the personal data phll holds about you, together with information about how it is processed.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update most Account information directly through your phll Account settings.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to phll's legal retention obligations under PAGCOR and AML regulations.
• Right to Object: The right to object to processing of your personal data for direct marketing purposes, or where phll relies on legitimate interest as the legal basis for processing.
• Right to Data Portability: The right to receive a copy of personal data you have provided to phll in a structured, commonly used, machine-readable format.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phll has processed your personal data in breach of RA 10173.

11.2 To exercise any of the above rights, please contact the phll Data Protection Officer using the contact details in Section 14. phll will respond to valid requests within thirty (30) calendar days of receipt.

11.3 phll may request appropriate verification of your identity before processing a data rights request, to ensure that personal data is not disclosed to or acted upon by unauthorized parties.

12 Children and Minors

12.1 If phll becomes aware that personal data has been collected from an individual under the age of twenty-one (21), phll will take immediate steps to delete such data from its systems, close the associated Account, and return any deposited funds to the source payment method.

12.2 If you have reason to believe that a minor has accessed or registered on the phll Platform, please contact phll immediately at the email address in Section 14 so that appropriate action can be taken.

13 Amendments to This Policy

13.1 phll reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or phll's data processing practices. Material amendments will be communicated to registered Players by email to the address on their Account no less than fourteen (14) calendar days prior to the effective date, except where an immediate amendment is required by law.

13.2 The current version of this Policy, together with its effective date and version number, is always accessible at phll.asia/privacy-policy. Your continued use of the Platform after the effective date of an amendment constitutes your acknowledgment of and agreement to the revised Policy.

14 Contact and Data Protection Officer

14.1 For any questions, concerns, or requests relating to this Privacy Policy or phll's processing of your personal data, please contact phll's Data Protection Officer:

• Email: [email protected] (subject line: "Data Privacy Request")
• Response Time: phll targets a response to all data privacy inquiries within thirty (30) calendar days of receipt.
• Language: Inquiries may be submitted in English or Filipino (Tagalog).

14.2 If you are not satisfied with phll's response to your data privacy inquiry, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about how to lodge a complaint with the NPC is available at the NPC's official website.

Note: phll does not provide a direct link to external websites. Please search for the NPC Philippines official website independently to access their complaint procedures.