phplaysa Privacy Policy

This Privacy Policy applies to all personal data collected, processed, stored, and used by phplaysa ("we," "us," or "our") in connection with the operation of the phplaysa online casino and sports betting platform accessible at phplaysa.club ("the Platform"). It covers all interactions you have with phplaysa, including account registration, gameplay, deposits and withdrawals, customer support communications, and marketing activities.

phplaysa acts as the Personal Information Controller ("PIC") as defined under the Data Privacy Act of 2012. This means phplaysa determines the purposes and means by which your personal data is processed. Where phplaysa engages third-party service providers to process data on its behalf, those providers act as Personal Information Processors ("PIP") and are bound by data processing agreements that require them to handle your data in accordance with this Policy and applicable Philippine law.

This Policy should be read alongside phplaysa's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. In the event of any conflict between this Policy and those documents on matters of data privacy, this Privacy Policy shall prevail.

phplaysa collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include:

phplaysa does not collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. We do not collect biometric data, health information, or political or religious affiliations.

phplaysa collects personal data through the following channels and methods:

• Direct collection: Information you provide when registering for a phplaysa account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access and interact with the phplaysa Platform, including through cookies, web beacons, and server logs. See Section 9 for more detail on cookies.
• Third-party sources: Identity verification data from KYC service providers; fraud and risk signals from payment processors (GCash, PayMaya, BPI, BDO, Metrobank); and publicly available information used for AML screening purposes.
• Regulatory sources: Information received from PAGCOR or other Philippine regulatory authorities in connection with licensing, compliance, or player protection obligations.

phplaysa will always inform you at the point of collection what data is being collected and for what purpose, to the extent required by the Data Privacy Act of 2012.

phplaysa uses your personal data for the following purposes:

• Account management: Creating, maintaining, and securing your phplaysa account; verifying your identity and age (21+ requirement); processing login and authentication.
• Service delivery: Enabling you to access and play games on the phplaysa Platform; processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank; providing customer support.
• Regulatory compliance: Meeting phplaysa's obligations under PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act of 2012; responding to lawful requests from Philippine government authorities.
• Fraud prevention and security: Detecting and preventing fraudulent activity, money laundering, account takeover, and other prohibited conduct; monitoring for unusual transaction patterns.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behaviour; administering self-exclusion, deposit limits, and other responsible gaming tools; complying with PAGCOR player protection requirements.
• Marketing and promotions: Sending you information about phplaysa promotions, bonuses, and new games — but only where you have given your consent or where phplaysa has a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Platform improvement: Analysing aggregated usage data to improve the phplaysa Platform's performance, game selection, and user experience for Filipino players.

Under the Data Privacy Act of 2012, phplaysa processes your personal data on the following legal bases:

• Consent: Where you have given phplaysa your explicit consent to process your data for a specific purpose, such as receiving marketing communications or participating in optional promotional programmes.
• Contractual necessity: Where processing is necessary to perform the contract between you and phplaysa — that is, to provide you with access to the phplaysa Platform, process your transactions, and deliver the services you have signed up for.
• Legal obligation: Where processing is required for phplaysa to comply with its obligations under Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act, and the Data Privacy Act itself.
• Legitimate interests: Where processing is necessary for phplaysa's legitimate business interests — such as fraud prevention, platform security, and service improvement — provided those interests are not overridden by your rights and freedoms.

Where phplaysa relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent, please contact phplaysa's Data Protection Officer using the details in Section 13.

phplaysa may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank, to the extent necessary to process your deposits and withdrawals. These providers have their own privacy policies governing their use of your data.
• KYC and identity verification providers: Third-party services engaged by phplaysa to verify your identity and age in compliance with PAGCOR and AML requirements.
• Fraud prevention and AML screening services: Providers that assist phplaysa in detecting and preventing fraudulent transactions and money laundering activity.
• IT and platform infrastructure providers: Cloud hosting, database, and software service providers that support the operation of the phplaysa Platform, all of whom are bound by data processing agreements.
• Customer support platforms: Third-party live chat and ticketing systems used to deliver phplaysa's 24/7 customer support service.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission ("NPC"), and other Philippine government authorities, where phplaysa is legally required to disclose information.
• Professional advisers: Lawyers, auditors, and accountants engaged by phplaysa, subject to professional confidentiality obligations.

All third-party processors engaged by phplaysa are required to process your personal data only on phplaysa's documented instructions and in accordance with the Data Privacy Act of 2012. phplaysa conducts due diligence on all processors before engagement and reviews those arrangements periodically.

phplaysa retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your phplaysa account and for a minimum of five (5) years after account closure, in compliance with PAGCOR record-keeping requirements and AML obligations under RA 9160.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act and PAGCOR regulations.
• KYC verification documents: Retained for a minimum of five (5) years after the end of the business relationship, in line with AMLC requirements.
• Customer support communications: Retained for two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and usage data: Retained for up to twelve (12) months in identifiable form, after which it may be anonymised and retained for analytical purposes indefinitely.
• Marketing consent records: Retained for the duration of your consent and for one (1) year after withdrawal of consent, as evidence of the consent given.

When personal data is no longer required, phplaysa will securely delete or anonymise it in accordance with industry-standard data destruction practices. Where data cannot be immediately deleted due to technical constraints, it will be isolated from further processing until deletion is possible.

The security measures implemented by phplaysa include, but are not limited to:

• Encryption: All data transmitted between your device and the phplaysa Platform is encrypted using TLS (Transport Layer Security) protocols. Sensitive data at rest, including financial information and identity documents, is encrypted using AES-256 encryption.
• Access controls: Access to personal data within phplaysa's systems is restricted on a strict need-to-know basis. All staff with access to personal data undergo background checks and regular data privacy training.
• Two-factor authentication: phplaysa offers two-factor authentication ("2FA") for player accounts and requires it for all internal staff accessing production systems.
• Penetration testing and vulnerability assessments: phplaysa's platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Incident response: phplaysa maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, phplaysa will notify the National Privacy Commission and affected players within the timeframes required by the Data Privacy Act of 2012.

While phplaysa takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phplaysa login credentials and for notifying phplaysa immediately if you suspect any unauthorised access to your account.

phplaysa uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the phplaysa website. The following types of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session cookies that keep you logged in to your phplaysa account and security cookies that help detect fraudulent activity. These cannot be disabled.
• Functional cookies: Remember your preferences, such as your preferred language and display settings, to provide a more personalised experience on the phplaysa Platform.
• Analytics cookies: Collect aggregated, anonymised data about how players use the phplaysa Platform — such as which games are most popular and how long sessions last — to help phplaysa improve its services.
• Marketing cookies: Used only where you have given your consent, to deliver relevant phplaysa promotions and to measure the effectiveness of marketing campaigns.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the phplaysa Platform. Strictly necessary cookies cannot be disabled without impacting your ability to use the Platform.

phplaysa does not use cookies to track your activity on third-party websites unrelated to the phplaysa Platform.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phplaysa. To exercise any of these rights, please contact phplaysa's Data Protection Officer using the details in Section 13.

phplaysa employs age verification measures at the point of registration and during KYC verification to prevent underage individuals from accessing the Platform. If phplaysa becomes aware that personal data has been collected from a person under the age of 21 without appropriate parental or guardian consent, phplaysa will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that your child has registered on the phplaysa Platform, please contact phplaysa's Data Protection Officer immediately using the contact details in Section 13.

phplaysa reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or PAGCOR regulatory requirements. When material changes are made, phplaysa will notify registered players via their registered email address or mobile number, or by displaying a prominent notice on the phplaysa Platform, at least seven (7) days before the changes take effect.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how phplaysa protects your personal data. Your continued use of the phplaysa Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

Previous versions of this Privacy Policy are available upon written request to phplaysa's Data Protection Officer.

phplaysa has appointed a Data Protection Officer ("DPO") in accordance with the Data Privacy Act of 2012 and the requirements of the National Privacy Commission. The DPO is responsible for overseeing phplaysa's data protection strategy and ensuring compliance with applicable Philippine privacy law.

If you have any questions, concerns, or requests relating to this Privacy Policy or phplaysa's handling of your personal data, please contact the phplaysa Data Protection Officer:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe phplaysa has not handled your personal data in accordance with the Data Privacy Act of 2012.