Privacy Policy – How playphp Handles Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes the privacy practices of playphp ("playphp," "we," "us," or "our") with respect to personal data collected from users ("you," "your," or "Member") who access or use the playphp online gaming platform available at playphp.biz and all associated mobile interfaces, applications, and digital touchpoints (collectively, "the Services").

playphp is committed to protecting the personal data of its Filipino player community in a manner consistent with applicable data privacy laws, including the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, as well as any other applicable legislation in jurisdictions where playphp is authorized to operate.

By registering an account on playphp, you acknowledge that you have read, understood, and agreed to the practices described in this Policy. If you do not agree with any part of this Policy, please do not create or continue to use a playphp account. This Policy is incorporated by reference into the playphp Terms & Conditions and should be read alongside those Terms.

As a regulated online gaming platform serving the Philippine market, playphp is required by its operating authorization and applicable law to collect certain personal data for identity verification, age verification, anti-money laundering compliance, and responsible gaming administration. Many of the data collection practices described in this Policy are legally mandated rather than discretionary, and refusal to provide the required data may prevent playphp from opening or continuing an account.

2. Personal Data We Collect

playphp collects personal data in the following categories, depending on the nature of your interaction with the Services:

playphp does not collect special categories of sensitive personal data (as defined under the Data Privacy Act of 2012) except where specifically required by applicable regulatory obligations, such as health information relevant to responsible gaming assessments or biometric data used solely for identity verification purposes.

3. How We Use Your Personal Data

playphp uses the personal data it collects for the following purposes:

• Account management: Creating, maintaining, and administering your playphp account, including authentication, password recovery, and account security monitoring.
• Identity and age verification: Verifying that you meet the minimum age requirement of 21 years and confirming your identity in accordance with KYC obligations under applicable anti-money laundering and gaming regulations.
• Payment processing: Processing deposits via GCash, PayMaya, BPI, BDO, and Metrobank, and executing withdrawal requests to your verified payment method.
• Gaming services: Delivering games, recording and displaying game results, calculating and crediting winnings, and managing bonus and promotional entitlements.
• Legal and regulatory compliance: Meeting playphp's obligations under Philippine gaming regulations, the Data Privacy Act of 2012, Anti-Money Laundering Act requirements, and reporting obligations to PAGCOR and the Anti-Money Laundering Council (AMLC).
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, account takeovers, multi-accounting, money laundering, and other prohibited conduct.
• Responsible gaming: Monitoring gaming behavior to identify potential problem gambling indicators, enforcing self-exclusion requests, and administering deposit, loss, and session limits set by players.
• Customer support: Responding to inquiries, resolving disputes, and providing technical assistance via live chat, email, and other support channels.
• Platform improvement: Analyzing aggregated, anonymized usage data to improve platform performance, user interface design, game catalogue curation, and overall service quality.
• Marketing communications: Sending promotional information, bonus notifications, and service updates to players who have not opted out of such communications. You may opt out at any time through your account notification settings.

playphp does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by regulatory compliance processes.

4. Legal Basis for Processing

playphp processes your personal data on the following legal grounds under applicable data protection law:

• Performance of a contract: Processing necessary to provide you with the gaming services you have contracted for, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with Philippine law, including KYC and AML requirements, PAGCOR regulatory obligations, tax reporting, and mandatory responsible gaming measures.
• Legitimate interests: Processing for fraud prevention, platform security, multi-accounting detection, and service improvement where these interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and optional analytics, where you have provided explicit consent. You may withdraw consent for these activities at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Data Sharing and Disclosure

playphp does not sell your personal data to third parties. We share personal data only in the following circumstances and only to the extent necessary for the specified purpose:

• Payment processors: Your financial data is shared with GCash (Mynt), PayMaya (Voyager Innovations), and relevant Philippine banks solely for the purpose of executing your deposit and withdrawal instructions. These entities are independently regulated financial institutions with their own data protection obligations.
• Game software providers: Technical session data may be shared with licensed game studios (such as Pragmatic Play, PG Soft, Jili Games, and others) for game delivery and technical support purposes. Game studios do not receive your identity or financial data except where technically necessary for jackpot payouts.
• Identity verification services: Document and identity data may be processed by accredited third-party KYC verification providers under strict data processing agreements.
• Regulatory and law enforcement authorities: playphp is legally required to disclose certain information to PAGCOR, the AMLC, the National Privacy Commission (NPC), law enforcement agencies, and other Philippine government bodies upon valid legal demand or as part of mandatory reporting obligations.
• Professional advisors: Legal counsel, auditors, and compliance consultants may access personal data strictly within the scope of their professional engagement and subject to confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of playphp's business assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom playphp shares personal data are contractually required to maintain appropriate technical and organizational security measures and to use the data only for the purposes for which it was disclosed.

6. Cookies and Tracking Technologies

playphp uses cookies and similar tracking technologies on its website and platform to support essential functions and improve the gaming experience. The categories of cookies used are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, load-balancing cookies, and security tokens. They cannot be disabled without preventing access to the Services.
• Functional cookies: Remember your preferences such as language settings, game lobby display preferences, and last-visited game category to improve navigation convenience.
• Analytics cookies: Collect anonymized data about how players navigate the platform — which pages are visited, how long sessions last, and where technical errors occur. This data is used solely for internal platform improvement.
• Fraud prevention and security cookies: Assist in detecting suspicious activity, identifying multiple accounts linked to the same device, and verifying login authenticity.

playphp does not use third-party advertising cookies or behavioral tracking technologies for the purpose of serving targeted advertisements on external platforms. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will prevent platform access.

7. Data Retention

playphp retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following retention considerations:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements under Philippine law.
• KYC documentation is retained for a minimum of five (5) years following the date of last verification or account closure, whichever is later.
• Customer support communications are retained for three (3) years following resolution of the matter to which they relate.
• Responsible gaming data, including self-exclusion records, is retained for a minimum of six (6) years to prevent circumvention of exclusion orders through re-registration.
• Technical and log data is retained for twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to an identified individual. Anonymized, aggregated data may be retained indefinitely for statistical and business intelligence purposes.

8. Data Security

playphp implements technical and organizational measures appropriate to the risk level associated with the personal data it processes. Key security measures include:

• Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and playphp's servers.
• Encryption at rest for sensitive personal data including identity documents, financial data, and government ID images.
• Role-based access controls limiting playphp staff access to personal data to that which is strictly necessary for their job function.
• Two-factor authentication available to all players for account access, and required internally for playphp staff accessing personal data systems.
• Regular security audits, penetration testing, and vulnerability assessments conducted by accredited third parties.
• Incident response procedures, including mandatory breach notification to the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of a qualifying personal data breach.

Despite these measures, no system is entirely immune to unauthorized access or data breach. In the event of a breach affecting your personal data, playphp will notify you directly via your registered email or mobile number in accordance with applicable notification obligations.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you hold the following rights with respect to your personal data held by playphp:

• Right to be informed: The right to be told what personal data playphp holds about you and how it is used — which this Policy fulfills.
• Right of access: The right to obtain a copy of the personal data playphp holds about you, subject to identity verification and applicable exemptions.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held about you.
• Right to erasure (right to be forgotten): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to object: The right to object to processing based on legitimate interests, including processing for direct marketing purposes. Objection to marketing processing will be honored unconditionally.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe playphp has handled your personal data in violation of the Data Privacy Act.

To exercise any of the above rights, contact the playphp Data Protection Officer at [email protected] with the subject line "Data Privacy Request." playphp will respond within thirty (30) calendar days of receiving a valid request. playphp may request identity verification before processing data subject requests.

10. Children's Privacy

The playphp platform is strictly prohibited for persons under the age of 21. playphp does not knowingly collect personal data from individuals below this age. As part of the registration process, all users are required to confirm their date of birth and to provide a government-issued Philippine ID for age verification purposes.

If playphp becomes aware that it has inadvertently collected personal data from an individual under 21 years of age, it will immediately close the associated account, return any deposited funds, delete all personal data collected in connection with that account, and report the incident to relevant authorities as required by law.

If you believe that an underage individual has registered a playphp account, please contact playphp immediately at [email protected].

11. International Data Transfers

playphp is primarily operated to serve Filipino players within the Philippines, and the majority of personal data processing occurs within infrastructure serving the Philippine market. However, some technical service providers — including cloud hosting, security services, and game studio infrastructure — may be located outside the Philippines.

Where personal data is transferred to recipients in jurisdictions that may not provide the same level of data protection as Philippine law, playphp ensures that appropriate safeguards are in place, including contractual clauses that bind recipients to data protection standards equivalent to those required under the Data Privacy Act of 2012.

By using the playphp platform, you acknowledge and consent to the transfer of your personal data to recipients in other jurisdictions where such transfer is necessary to provide the Services, subject to the safeguards described above.

12. Updates to This Privacy Policy

playphp may update this Privacy Policy from time to time to reflect changes in its data processing practices, changes in applicable law, or changes in its business operations. The "Last updated" date at the top of this Policy will be revised whenever a material change is made.

Material changes to this Policy will be communicated to registered playphp members via the email address or mobile number associated with their account at least fourteen (14) days before the updated Policy takes effect. For non-material changes — such as corrections to typographical errors, clarification of existing practices without substantive change, or additions of new contact details — playphp may update the Policy without advance notice.

Your continued use of the playphp platform after the effective date of an updated Privacy Policy constitutes your acceptance of the updated practices. If you do not accept a material change to this Policy, you may close your account in accordance with the Terms & Conditions.

13. Contact — Data Protection Officer

For all privacy-related queries, data subject rights requests, data breach notifications received by you, or complaints relating to playphp's data processing practices, please contact:

Data Protection Officer — playphp
Email: [email protected]
Subject line: "Data Privacy Request" or "Data Privacy Complaint"
Response time: Within 30 calendar days of verified receipt.

If your concern is not resolved to your satisfaction through playphp's internal process, you have the right to escalate the matter to the National Privacy Commission of the Philippines at its official website and contact channels.