phpasay Privacy Policy

01 Introduction

phpasay is committed to protecting the privacy and personal data of every player who uses our online gaming platform. We understand that trust is the foundation of any good relationship — and that trust starts with being transparent about how we handle your information.

This Privacy Policy has been prepared in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. It applies to all personal data collected through the phpasay website at phpasay.one, our mobile platform, customer support channels, and any other services we provide.

As a platform serving Filipino players across Metro Manila, Cebu, Davao, Quezon City, Makati, and beyond, phpasay takes its obligations as a personal information controller seriously. We process your data lawfully, fairly, and transparently — and only for the specific purposes described in this policy.

02 Personal Data We Collect

phpasay collects different categories of personal data depending on how you interact with our platform. The following table summarizes the types of data we collect and the context in which they are gathered:

Data Category	Examples	When Collected
Identity Data	Full name, date of birth, government-issued ID number, selfie/photo for KYC	Account registration and KYC verification
Contact Data	Email address, mobile number, home address	Account registration and profile updates
Financial Data	GCash number, PayMaya account, BPI/BDO/Metrobank account details, transaction history	Deposits, withdrawals, and payment processing
Gaming Data	Game history, wager amounts, win/loss records, session duration, bonus usage	During active gameplay on the platform
Technical Data	IP address, device type, browser type, operating system, login timestamps	Automatically upon accessing the platform
Communications Data	Live chat transcripts, support ticket content, email correspondence	When you contact phpasay support
Preference Data	Responsible gaming settings, notification preferences, language settings	When you update your account settings

phpasay does not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where strictly required by law or regulation (for example, health-related information provided voluntarily in connection with a self-exclusion request).

03 How We Collect Your Data

phpasay collects personal data through the following channels:

• Direct interactions: Data you provide when registering a phpasay account, completing KYC verification, making deposits or withdrawals, contacting our support team, or updating your account profile.
• Automated technologies: Technical data collected automatically when you access the phpasay platform, including cookies, server logs, and similar tracking technologies. See Section 07 for more details on our cookie practices.
• Third-party sources: Identity verification data from KYC service providers, fraud prevention data from security partners, and payment confirmation data from GCash, PayMaya, BPI, BDO, and Metrobank.
• Regulatory sources: Information received from PAGCOR or other regulatory authorities in connection with compliance obligations, including self-exclusion registers.

04 How We Use Your Personal Data

phpasay uses the personal data we collect for the following specific purposes:

• Account management: To create, maintain, and manage your phpasay player account, including verifying your identity and age (21+ requirement) during registration.
• Service delivery: To provide access to phpasay games including slots, bingo, live dealer games, fishing games, and all other platform features.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods.
• KYC and fraud prevention: To verify your identity, prevent fraud, money laundering, and other illegal activities, and to comply with Anti-Money Laundering (AML) obligations.
• Regulatory compliance: To fulfill phpasay's obligations under PAGCOR regulations, the Philippine Data Privacy Act, and other applicable laws.
• Customer support: To respond to your inquiries, resolve disputes, and provide technical assistance through our 24/7 support channels.
• Responsible gaming: To monitor gaming behavior, enforce deposit limits and self-exclusion requests, and provide responsible gaming tools in line with PAGCOR guidelines.
• Platform improvement: To analyze usage patterns, troubleshoot technical issues, and improve the overall phpasay gaming experience.
• Communications: To send you important account notifications, security alerts, and — where you have opted in — promotional communications about phpasay offers and bonuses.

phpasay will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phpasay processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfill our obligations under the phpasay Terms & Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable Philippine laws, PAGCOR regulations, Anti-Money Laundering Act (AMLA) requirements, and National Privacy Commission directives.
• Legitimate interests: Processing necessary for phpasay's legitimate business interests, including fraud prevention, platform security, and service improvement, where these interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — particularly for marketing communications and optional data uses. You may withdraw consent at any time.

06 Data Sharing and Disclosure

phpasay does not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers: Third-party services that assist phpasay in verifying player identities and ages in compliance with PAGCOR requirements.
• Fraud prevention and security partners: Services that help phpasay detect and prevent fraudulent activity, money laundering, and unauthorized account access.
• Game software providers: Licensed game developers and providers whose games are available on the phpasay platform, to the extent necessary for game delivery and fairness auditing.
• Regulatory authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other Philippine government bodies, where disclosure is required by law or regulation.
• IT and hosting providers: Cloud infrastructure and technology service providers who host and maintain the phpasay platform, subject to strict data processing agreements.

07 Cookies and Tracking Technologies

phpasay uses cookies and similar tracking technologies to enhance your experience on the platform, maintain your session, and gather analytical data about platform usage. The following types of cookies are used:

• Strictly necessary cookies: Essential for the phpasay platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, responsible gaming limits, and display preferences to provide a more personalized experience.
• Analytical cookies: Help phpasay understand how players use the platform — which games are most popular, where players encounter difficulties, and how the platform can be improved. Data collected is aggregated and anonymized where possible.
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized logins, and bot activity on the phpasay platform.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the phpasay platform. phpasay does not use third-party advertising cookies or behavioral tracking cookies for cross-site advertising purposes.

08 Data Retention

phpasay retains your personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Account data: Retained for the duration of your active phpasay account, plus a minimum of five (5) years following account closure, in accordance with PAGCOR record-keeping requirements.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act of the Philippines.
• KYC and identity documents: Retained for the duration of your account plus five (5) years, or longer if required by regulatory directive.
• Customer support records: Retained for three (3) years from the date of the last interaction, unless a longer period is required for dispute resolution.
• Technical and log data: Retained for up to twelve (12) months for security and fraud prevention purposes.

Upon expiry of the applicable retention period, phpasay will securely delete or anonymize your personal data in accordance with our data disposal procedures.

09 Data Security

phpasay implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phpasay platform.
• Encryption of sensitive data at rest, including financial information and identity documents.
• Role-based access controls ensuring that phpasay staff can only access personal data necessary for their specific job functions.
• Regular security audits, penetration testing, and vulnerability assessments of the phpasay platform.
• Multi-factor authentication requirements for administrative access to phpasay systems.
• Incident response procedures for detecting, reporting, and responding to personal data breaches in accordance with NPC notification requirements.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phpasay:

• Right to be informed: The right to know what personal data phpasay collects about you, how it is used, and with whom it is shared — as described in this Privacy Policy.
• Right of access: The right to request a copy of the personal data phpasay holds about you, along with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data phpasay holds about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phpasay's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on phpasay's legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe phpasay has violated your data privacy rights.

To exercise any of these rights, please contact the phpasay Data Protection Officer at the email address provided in Section 14 of this policy. phpasay will respond to all verified data subject requests within fifteen (15) business days of receipt.

11 Children's Privacy

The phpasay platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gambling regulations. phpasay does not knowingly collect personal data from individuals under the age of 21.

If phpasay discovers or is notified that personal data has been collected from a person under the age of 21, we will immediately close the associated account, delete all related personal data, and — where applicable — report the matter to the relevant regulatory authority.

Parents and guardians who believe their child may have accessed the phpasay platform are encouraged to contact our support team immediately so that appropriate action can be taken without delay.

12 Cross-Border Data Transfers

In some cases, phpasay may transfer your personal data to service providers or partners located outside the Philippines — for example, cloud infrastructure providers or game software developers based in other jurisdictions. When such transfers occur, phpasay ensures that appropriate safeguards are in place to protect your data, including:

• Entering into data transfer agreements that incorporate the standard contractual clauses recognized by the National Privacy Commission of the Philippines.
• Transferring data only to countries or organizations that provide an adequate level of data protection as determined by the NPC.
• Obtaining your explicit consent for transfers to jurisdictions that do not provide an adequate level of protection, where required by law.

phpasay will not transfer your personal data to any jurisdiction or recipient that cannot provide adequate data protection guarantees consistent with the Philippine Data Privacy Act.

13 Updates to This Privacy Policy

phpasay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, phpasay will notify registered players via the email address associated with their account and/or by displaying a prominent notice on the platform.

The effective date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about how phpasay protects your personal data. Your continued use of the phpasay platform following any update constitutes your acceptance of the revised Privacy Policy.

14 Contact Us and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the way phpasay handles your personal data, please contact our Data Protection Officer (DPO). Our DPO is responsible for overseeing phpasay's compliance with the Philippine Data Privacy Act and is your primary point of contact for all data privacy matters.

You may reach the phpasay Data Protection Officer by email at:

[email protected]

Please include "Data Privacy Request" in the subject line of your email, along with your registered phpasay username and a clear description of your request. phpasay will acknowledge receipt of your request within three (3) business days and provide a full response within fifteen (15) business days.

If you are not satisfied with phpasay's response to your data privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines at privacy.gov.ph.