phi68 Privacy Policy — How We Handle Your Personal Data

1. Personal Data We Collect

phi68 collects personal data through several means: directly from you during account registration and ongoing use of the Platform, automatically through your interaction with our systems, and from third parties where permitted by law.

1.1 Information You Provide Directly

• Account Registration: Full legal name, date of birth, nationality, email address, mobile number, and residential address.
• Identity Verification (KYC): Government-issued identification documents (e.g., Philippine passport, driver's license, SSS or UMID card), selfie photographs, and proof of address documents such as utility bills or bank statements.
• Financial Information: GCash account details, Maya (PayMaya) account details, bank account numbers (BPI, BDO, Metrobank, or other Philippine banks), and transaction records.
• Communications: Messages sent to our customer support team via live chat, email, or any other communication channel.
• Preferences and Settings: Responsible gaming limits, notification preferences, and language settings you configure within your account.

1.2 Information Collected Automatically

• Technical Data: IP address, device type, operating system, browser type and version, and screen resolution.
• Usage Data: Pages visited, games played, time spent on the Platform, session duration, wagering history, bonus usage, and click patterns.
• Location Data: Approximate geographic location derived from your IP address, used solely for regulatory compliance and access restriction purposes.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies as described in Section 9 of this Policy.

1.3 Information from Third Parties

phi68 may receive personal information about you from third-party identity verification providers, payment processors, fraud prevention services, and regulatory databases where such collection is necessary for legal compliance or the performance of our contractual obligations to you.

2. How phi68 Uses Your Personal Data

We use the personal data we collect only for legitimate, specified, and explicitly defined purposes. The primary purposes for which phi68 processes your personal data are:

3. Legal Basis for Processing

Under the Data Privacy Act of 2012, phi68 processes your personal data on the following lawful bases:

• Contractual Necessity: Processing required to perform our contract with you, including operating your account, processing transactions, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (AMLA), PAGCOR regulations, and NPC directives.
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, where these interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, particularly for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Sharing of Personal Data

phi68 does not sell, rent, or trade your personal information to third parties for commercial purposes. We may share your personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

4.1 Service Providers and Processors

We engage trusted third-party service providers who process personal data on our behalf under contractual data processing agreements that require them to maintain confidentiality and implement appropriate security measures. These include identity verification providers, payment processors (including GCash and Maya infrastructure partners), cloud hosting services, fraud detection platforms, and customer support software providers.

4.2 Regulatory and Law Enforcement Authorities

phi68 will disclose personal data to competent Philippine government authorities, including the Anti-Money Laundering Council (AMLC), PAGCOR, the National Privacy Commission, and law enforcement agencies, when required to do so by law, court order, or other binding legal process.

4.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets involving phi68, your personal data may be transferred to the successor entity, subject to the same or equivalent data protection commitments as described in this Policy. We will notify affected users in advance of any such transfer where legally required.

5. Data Retention

phi68 retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. In practice, this means:

• Active Account Data: Retained for the duration of your active account relationship with phi68.
• KYC and Identity Documents: Retained for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Support and Communication Records: Retained for three (3) years from the date of the interaction.
• Marketing Consent Records: Retained until consent is withdrawn, plus a period sufficient to demonstrate compliance with the DPA.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymized in accordance with NPC guidelines on personal data disposal.

6. Security of Your Personal Data

phi68 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phi68 Platform.
• Encryption of sensitive data at rest, including payment information and identity documents, using industry-standard cryptographic protocols.
• Multi-factor authentication (MFA) options available for all phi68 accounts.
• Role-based access controls limiting internal access to personal data strictly to personnel who require it to perform their job functions.
• Regular internal and third-party security audits, penetration testing, and vulnerability assessments.
• Incident response procedures aligned with NPC breach notification requirements under the DPA.

While phi68 takes every reasonable precaution to safeguard your data, no method of electronic transmission or storage is completely infallible. We encourage you to use a strong, unique password for your phi68 account and to enable MFA where available.

7. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, Filipino players and all users of the phi68 Platform enjoy the following rights with respect to their personal data:

• Right to be Informed: The right to know whether phi68 processes your personal data, the purposes for which it is processed, and who receives it.
• Right of Access: The right to request a copy of the personal data phi68 holds about you and information about how it is processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held in your phi68 account.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to our legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes at any time, without charge.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact phi68's Data Protection Officer by emailing [email protected] with the subject line "Data Privacy Request." We will respond to all verifiable requests within fifteen (15) business days in accordance with NPC guidelines.

8. Cookies and Tracking Technologies

phi68 uses cookies and similar tracking technologies to enhance your experience on the Platform, remember your preferences, analyze usage patterns, and deliver relevant content. The categories of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your logged-in state and security tokens that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: These remember your preferences, such as language settings, display options, and responsible gaming limits you have set.
• Analytics Cookies: These collect anonymized information about how users navigate the Platform, which pages are most visited, and where technical errors occur. This data is used solely to improve Platform performance.
• Marketing Cookies: Used only where you have provided explicit consent to receive personalized promotional communications. You may withdraw this consent at any time through your account settings.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the phi68 Platform. For full details on specific cookies used, please refer to our Cookie Notice available within the Platform's account settings section.

9. Protection of Minors

The phi68 Platform is strictly intended for users who are twenty-one (21) years of age or older. We do not knowingly collect, process, or retain personal data from individuals below the age of twenty-one (21). In compliance with PAGCOR age restriction requirements and the DPA's provisions on sensitive personal information relating to minors, phi68 implements robust age verification measures at the point of account registration and at any point where we have reason to doubt a user's age.

If phi68 discovers that personal data has been collected from a user below the minimum age of twenty-one (21), we will immediately suspend the relevant account, delete the collected data without undue delay, and notify relevant regulatory authorities where required. If you have reason to believe that a minor has registered on phi68 using false information, please contact us immediately at [email protected].

10. Changes to This Privacy Policy

phi68 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes will be communicated to registered users via email or through a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

Your continued use of the phi68 Platform following notification of any changes to this Policy constitutes your acceptance of those changes. We encourage you to review this Policy periodically. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

11. Data Protection Officer and Contact

phi68 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests regarding how your personal data is handled by phi68, please contact our DPO:

• Email: [email protected] (subject line: "Data Privacy Request")
• Response Time: Within fifteen (15) business days of receipt of a verifiable request
• Availability: Our support team is available 24/7 via live chat for urgent privacy concerns

If you are unsatisfied with our response to any privacy-related concern, you have the right to file a formal complaint with the National Privacy Commission (NPC) of the Philippines, which serves as the competent supervisory authority for data protection matters under the DPA.