phmanila Privacy Policy

1 Introduction

1.1 phmanila ("we," "us," "our," "the Platform") operates the online gaming platform available at phmanila.app. As an operator serving Filipino players across the Philippines — from Metro Manila and Cebu to Davao and beyond — phmanila processes personal data in the course of providing casino, sports betting, bingo, and related gaming services.

1.2 This Privacy Policy has been prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations, as enforced by the National Privacy Commission ("NPC"). phmanila also observes the data-related obligations imposed by the Philippine Amusement and Gaming Corporation ("PAGCOR") as part of its licensing and regulatory framework.

1.3 This Privacy Policy should be read in conjunction with phmanila's Terms and Conditions, which govern the overall relationship between phmanila and its players. The Terms and Conditions are available at phmanila.app/terms-conditions. In the event of any conflict between this Privacy Policy and the Terms and Conditions specifically regarding the processing of personal data, this Privacy Policy shall prevail.

1.4 phmanila is committed to processing personal data lawfully, fairly, and transparently. We collect only the data necessary for the purposes described in this Policy, retain it only for as long as necessary, and apply appropriate security measures at every stage of processing.

2 Data Controller

2.1 The data controller responsible for the personal information of phmanila players is the phmanila platform operating entity, accessible at phmanila.app. As data controller, phmanila determines the purposes and means of processing your personal data.

2.2 phmanila has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO can be contacted via the support address listed in Section 15 of this Policy.

2.3 Where phmanila engages third-party service providers to process personal data on our behalf (such as payment processors, KYC verification providers, and game technology providers), those parties operate as data processors under phmanila's instruction and are bound by data processing agreements that require them to protect personal data in accordance with applicable Philippine law.

3 Categories of Personal Data We Collect

3.1 phmanila collects and processes the following categories of personal data, depending on the nature of your interaction with the platform:

3.1 Identity and Contact Data

• Full legal name as it appears on a government-issued Philippine ID;
• Date of birth (used for age verification — players must be 21 or older);
• Email address;
• Philippine mobile number (used for OTP verification and account security);
• Residential address (requested during enhanced KYC where applicable);
• Government-issued identification document numbers (e.g., PhilSys ID, Passport, Driver's License).

3.2 Financial and Payment Data

• GCash mobile number linked to your phmanila wallet;
• Maya (PayMaya) account identifiers;
• Bank account information (where bank transfers are used for deposits or withdrawals);
• Transaction history including deposit amounts, withdrawal requests, and payment method details;
• Cryptocurrency wallet addresses (for USDT TRC20 transactions).

3.3 Gaming and Account Activity Data

• Game session records including games played, bet amounts, wins, losses, and session duration;
• Bonus and promotion history;
• Account login history including timestamps, IP addresses, and device information;
• Responsible gaming settings including deposit limits, session limits, and self-exclusion status;
• Customer support interaction records.

3.4 Technical and Usage Data

• IP address and approximate geolocation;
• Browser type, version, and operating system;
• Device identifiers (device model, screen resolution, device fingerprint);
• Pages visited on phmanila.app and time spent on each page;
• Referral source (how you arrived at phmanila.app).

4 How We Collect Your Data

4.1 phmanila collects personal data through the following channels and mechanisms:

5 Legal Basis for Processing

5.1 phmanila processes personal data on the following legal bases as recognized under the Data Privacy Act of 2012:

• Contractual Necessity: Processing your identity, payment, and account data is necessary to perform the contract between you and phmanila — specifically, to provide gaming services, process transactions, and manage your account.
• Legal Obligation: phmanila is required by PAGCOR regulations and the Anti-Money Laundering Act (RA 9160 and amendments) to collect and verify identity information, maintain transaction records, and report suspicious activities to the appropriate authorities. This processing is mandatory and cannot be declined by players.
• Legitimate Interests: phmanila processes certain technical and usage data for legitimate interests including fraud prevention, platform security, responsible gaming monitoring, and improving the quality and performance of our services. Such processing is proportionate and does not override players' fundamental rights.
• Consent: Where phmanila relies on consent as the legal basis for processing (e.g., for certain marketing communications), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

6 How phmanila Uses Your Personal Data

6.1 phmanila uses personal data collected from players for the following purposes:

6.1 Account Management and Service Provision

To create and maintain your phmanila account, verify your identity, authenticate your logins, process deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, and other payment channels, and to deliver the gaming services you access on the platform.

6.2 Regulatory Compliance and Anti-Money Laundering

To comply with PAGCOR's Know Your Customer requirements, the Anti-Money Laundering Act of 2001, and any other applicable Philippine laws. This includes verifying that all players are at least 21 years of age, maintaining transaction records for the periods required by law, and filing reports to the Anti-Money Laundering Council (AMLC) where legally required.

6.3 Fraud Prevention and Platform Security

To detect and prevent fraud, account takeovers, multi-accounting, bonus abuse, collusion, and other prohibited conduct as defined in phmanila's Terms and Conditions. This includes automated monitoring of login patterns, transaction anomalies, and gameplay behavior.

6.4 Responsible Gaming

To operate phmanila's responsible gaming program — including monitoring for signs of problem gambling behavior, applying deposit limits and session restrictions, processing self-exclusion requests, and complying with PAGCOR's responsible gaming guidelines.

6.5 Customer Support

To respond to your queries, process complaints, resolve disputes, and maintain records of support interactions for quality assurance and training purposes.

6.6 Platform Improvement and Analytics

To analyze aggregated, anonymized usage data to understand how Filipino players use phmanila, identify areas for improvement, optimize game library curation, and enhance the overall platform experience. No individually identifiable data is used for analytical reporting.

6.7 Marketing Communications

Where you have provided consent, to send you information about promotions, bonuses, new games, and phmanila updates via email or SMS. You may unsubscribe from marketing communications at any time by contacting support or updating your communication preferences in account settings, without affecting your ability to use the platform.

7 Data Sharing and Disclosure

7.1 phmanila does not disclose personal data to third parties except in the following circumstances:

• Payment Processors: phmanila shares payment-related data with GCash, Maya, and banking partners solely to the extent necessary to process your deposit and withdrawal transactions.
• KYC and Identity Verification Providers: phmanila engages licensed identity verification service providers to assist with document verification and fraud screening. These providers process your identity data under strict contractual controls and are prohibited from using it for any purpose other than verification.
• Game Technology Providers: Game providers (including Pragmatic Play, Evolution, Jili, and others) may receive limited gameplay data necessary to run their games on the phmanila platform. These providers are independent data controllers for their own game infrastructure.
• PAGCOR: As phmanila's regulator, PAGCOR may request access to player data, transaction records, and compliance documentation as part of its regulatory oversight functions. phmanila is legally obligated to comply with such requests.
• Law Enforcement and Government Agencies: phmanila will disclose personal data to the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), the Philippine National Police (PNP), or other government bodies when required by law, court order, or to protect the rights, safety, and property of phmanila, its players, or the public.
• Professional Advisors: phmanila's legal counsel, auditors, and compliance consultants may access personal data to the extent necessary to provide their professional services, subject to confidentiality obligations.

7.2 In all cases where personal data is shared with third parties, phmanila takes reasonable steps to ensure that the recipient applies adequate data protection measures consistent with the Data Privacy Act of 2012.

8 Cookies and Tracking Technologies

8.1 phmanila uses cookies and similar tracking technologies on phmanila.app to deliver and improve our services. Cookies are small text files stored on your device when you visit our platform.

8.2 phmanila uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of phmanila.app — including maintaining your logged-in session, remembering your language preference, and enabling secure account access. These cookies cannot be disabled without impairing platform functionality.
• Performance and Analytics Cookies: Used to collect anonymized data on how players navigate phmanila.app, which pages are most visited, and where errors occur. This data helps phmanila improve the platform. No personally identifiable information is included in analytics data.
• Functional Cookies: Used to remember your account preferences such as your preferred game category, display settings, and responsible gaming configurations between sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, identify unusual login patterns, and support phmanila's account security systems.

8.3 Most web browsers allow you to manage or delete cookies through your browser settings. However, disabling strictly necessary cookies may impair your ability to log in to and use phmanila. Instructions for managing cookies are available in your browser's help documentation.

9 Data Security

9.1 phmanila implements a comprehensive set of technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and phmanila servers is encrypted using 256-bit SSL/TLS — the same encryption standard used by Philippine banks and major e-wallets including GCash.
• Encryption at Rest: Sensitive personal data stored on phmanila's servers, including identity documents and financial information, is encrypted using industry-standard encryption protocols.
• Password Hashing: Player passwords are stored using one-way cryptographic hashing. phmanila does not store passwords in readable form, and even phmanila staff cannot access your actual password.
• Access Controls: Access to personal data within phmanila is restricted on a strict need-to-know basis. Staff with access to sensitive data are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their phmanila accounts. Platform staff accounts with access to player data require mandatory multi-factor authentication.
• Intrusion Detection and Monitoring: phmanila's systems are continuously monitored for unauthorized access attempts, unusual data access patterns, and security incidents.
• Data Breach Response: In the event of a personal data breach, phmanila will notify affected players and report the breach to the National Privacy Commission (NPC) within the timeframes required by the Data Privacy Act of 2012.

9.2 While phmanila takes all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. phmanila cannot guarantee absolute security, but we are committed to addressing any identified vulnerabilities promptly.

10 Data Retention

10.1 phmanila retains personal data for the period necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods required by applicable Philippine law:

• Account and Identity Data: Retained for the duration of your account plus a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act of 2001.
• KYC Documents: Retained for the duration of your account plus five (5) years, or longer where required by a specific regulatory direction or legal proceeding.
• Game History: Retained for a minimum of two (2) years following the conclusion of each game session, for dispute resolution purposes.
• Customer Support Records: Retained for two (2) years following the resolution of each support interaction.
• Marketing Preferences: Retained until you withdraw consent or request erasure, provided this does not conflict with other legal retention obligations.

10.2 Following the expiry of applicable retention periods, personal data is securely deleted or anonymized such that it can no longer be associated with any individual player. Where anonymization is not possible, data is deleted using secure deletion methods.

11 Your Data Rights Under Philippine Law

11.1 As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phmanila:

11.2 To exercise any of these rights, please contact phmanila's Data Protection Officer via the contact details in Section 15. phmanila will respond to all data rights requests within thirty (30) calendar days of receipt. Complex requests may require additional time, in which case phmanila will notify you of the expected response date.

11.3 Where phmanila declines a data rights request (for example, because fulfilling it would conflict with a legal retention obligation), we will provide a written explanation of the reason for the decline and inform you of your right to escalate the matter to the National Privacy Commission.

12 Children and Underage Persons

12.1 phmanila actively verifies the age of all players through its KYC process and takes all reasonable steps to prevent access by underage persons. If phmanila discovers or reasonably suspects that personal data has been collected from an individual under the age of 21, all associated data will be immediately deleted (subject to any legal reporting obligations), and the account will be permanently closed.

12.2 If you are a parent or guardian and believe that a person under the age of 21 has accessed or registered at phmanila, please contact us immediately at the address provided in Section 15. phmanila will investigate and take appropriate action, including permanent account closure, within 48 hours of a confirmed report.

13 International Data Transfers

13.1 phmanila's primary data infrastructure is located in the Philippines or in data centers operated by providers with Philippine operations. In certain limited circumstances, personal data may be processed or stored in servers located outside the Philippines — for example, where phmanila engages international game technology providers, cloud infrastructure services, or fraud prevention vendors.

13.2 Where personal data is transferred outside the Philippines, phmanila takes appropriate steps to ensure that the recipient provides an adequate level of data protection, including through the use of contractual clauses and data processing agreements that impose obligations equivalent to those under the Data Privacy Act of 2012.

13.3 phmanila does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards, in accordance with NPC guidelines on cross-border data transfers.

14 Changes to This Privacy Policy

14.1 phmanila reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform operations. The "Effective Date" shown at the top of this Policy will be updated to reflect the date of the most recent revision.

14.2 Where changes to this Privacy Policy are material — meaning they significantly affect your rights as a data subject or change how phmanila uses your personal data — phmanila will provide at least fourteen (14) days' advance notice via email to your registered address and/or by prominent notice on the phmanila platform before the changes take effect.

14.3 Non-material changes (such as clarifications, typographical corrections, or reorganization of content without substantive change) may take effect immediately upon publication. Your continued use of phmanila following publication of an updated Privacy Policy constitutes your acknowledgment of the revised version.

14.4 The current version of this Privacy Policy is always available at phmanila.app/privacy-policy.

15 Contact, Data Rights Requests & Complaints

15.1 If you have any questions about this Privacy Policy, wish to exercise your data rights under the Data Privacy Act of 2012, or have a complaint about how phmanila has handled your personal data, please contact phmanila's Data Protection Officer using the following details:

15.2 If you are not satisfied with phmanila's response to a data rights request or privacy complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the government body responsible for enforcing the Data Privacy Act of 2012. Information about how to file a complaint with the NPC is available on the NPC's official government website.

15.3 When submitting a data rights request, please include your full name, registered email address, a description of your request, and, where applicable, a copy of a valid Philippine government-issued ID to confirm your identity. phmanila will not process data rights requests that cannot be linked to a specific, verified account holder.