php889 Privacy Policy – Your Data, Protected

1 Introduction

php889 is committed to protecting the privacy and personal data of every player on our platform. We recognise that trust is the foundation of everything we do — and that means being fully transparent about how personal information flows through the php889 ecosystem.

This Policy has been prepared in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC). It also reflects relevant obligations arising from php889's operating framework under PAGCOR.

This Policy applies to all personal data collected from:

• Registered Players and prospective players who submit registration inquiries.
• Visitors to the php889 website, whether or not they hold an account.
• Individuals who contact php889 customer support or submit complaints.
• Any individual whose personal data php889 receives in connection with its regulated gaming operations.

2 Who We Are

For the purposes of RA 10173, php889 is the Personal Information Controller (PIC) in respect of personal data collected through the Platform. As PIC, php889 determines the purposes and means of processing your personal data and is legally responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

php889 operates as a PAGCOR-regulated online casino and sports betting platform serving Filipino players aged 21 and above. Our operations are based in the Philippines, and all data processing activities are subject to Philippine law.

Contact details for our Data Protection Officer (DPO) are provided in Section 14 of this Policy. The DPO is responsible for overseeing php889's compliance with RA 10173 and serving as the primary point of contact for data subject inquiries.

3 Personal Data We Collect

php889 collects personal data in the following categories depending on your interaction with the Platform:

3.1 Identity and Registration Data

• Full legal name as it appears on a government-issued identification document.
• Date of birth (used for mandatory age verification — php889 is strictly for players aged 21 and above).
• Gender and nationality.
• Government-issued ID type and number (e.g., PhilSys ID, SSS, UMID, passport, driver's license).
• Residential address, including barangay, city/municipality, province, and postal code.

3.2 Contact Data

• Email address (used for account communications, promotional messages where consented, and security alerts).
• Mobile phone number (used for account verification and two-factor authentication).

3.3 Financial and Transaction Data

• GCash account reference or PayMaya account reference (account identifiers only — never login credentials or PINs).
• Bank account details for BPI, BDO, or Metrobank transfers (account name and number only).
• Visa or Mastercard details (processed and stored exclusively by our PCI DSS-compliant payment processor — php889 does not store full card numbers).
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment methods.

3.4 Gameplay and Platform Usage Data

• Game session logs including games played, wager amounts, win/loss outcomes, and session durations.
• Responsible gaming tool usage including deposit limit settings, session reminders, and self-exclusion requests.
• Bonus and promotional participation records.
• Customer support interaction records including chat logs, email correspondence, and complaint submissions.

3.5 Technical and Device Data

• IP address and approximate geolocation derived from IP.
• Device type, operating system, and browser type.
• Session timestamps and login history.
• Cookie identifiers and similar tracking data as described in Section 7.

4 How We Use Your Personal Data

php889 processes your personal data for the following specific purposes:

• Account creation and management: To register, verify, and maintain your php889 player account, including identity verification (KYC) as required by PAGCOR regulations.
• Age verification: To confirm that you are aged 21 or above before granting access to real-money gaming features on the Platform.
• Payment processing: To facilitate deposits and withdrawals via your registered payment method, verify ownership of payment instruments, and maintain transaction records as required by anti-money laundering regulations.
• Game delivery and platform operation: To provide access to games, record gameplay activity for dispute resolution, and ensure platform integrity.
• Regulatory compliance: To meet php889's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), RA 10173, and other applicable Philippine laws.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account abuse, money laundering, and other prohibited conduct.
• Responsible gaming: To monitor gameplay patterns, administer responsible gaming tools, enforce self-exclusion requests, and fulfill PAGCOR's responsible gaming requirements.
• Customer support: To respond to your inquiries, process complaints, and resolve account disputes.
• Platform improvements: To analyse aggregated, anonymised usage data for the purposes of improving php889's products, services, and user experience.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates where you have given separate, opt-in consent. You may withdraw consent for marketing communications at any time.

5 Legal Basis for Processing

Under RA 10173, php889 processes your personal data on one or more of the following legal bases:

• Consent: Where you have given clear, freely given, specific, and informed consent — for example, when opting in to marketing communications or accepting this Policy at registration.
• Contractual necessity: Where processing is necessary to perform the contract between you and php889, including account management, payment processing, and game delivery.
• Legal obligation: Where processing is required to comply with a legal or regulatory obligation applicable to php889, including KYC requirements under PAGCOR licensing conditions and AML reporting obligations.
• Legitimate interests: Where processing is necessary for php889's legitimate interests — such as fraud prevention, platform security, and responsible gaming monitoring — provided that those interests are not overridden by your rights and freedoms as a data subject.

6 Sharing Your Personal Data

php889 does not sell, rent, or trade your personal data to third parties. We share personal data only in the following limited circumstances:

• Payment service providers: GCash (G-Xchange, Inc.), PayMaya (Maya Philippines, Inc.), BPI, BDO, Metrobank, and card processors are provided only the data necessary to execute your requested transactions. These providers are contractually bound to process your data solely for payment purposes.
• Game software providers: Licensed game providers whose titles appear on the php889 Platform may receive anonymised session identifiers for the purpose of delivering game content and resolving technical disputes. Personally identifiable information is not shared with game providers beyond what is strictly necessary.
• Identity verification services: Third-party KYC and identity verification platforms engaged by php889 to assist with document verification and fraud screening receive identity data solely for verification purposes.
• Regulatory authorities: php889 is obliged to share player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities upon lawful request or as required by applicable regulations.
• Legal proceedings: php889 may disclose personal data where required by a court order, subpoena, or other lawful legal process issued by a competent Philippine authority.
• Business transfers: In the event of a merger, acquisition, or transfer of business assets, personal data held by php889 may be transferred to the successor entity, subject to the same data protection obligations set out in this Policy. Affected users will be notified in advance where required by law.

7 Cookies and Tracking Technologies

php889 uses cookies and similar technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for core Platform functionality including user authentication, session management, and security features. These cannot be disabled without impairing your ability to use the Platform.
• Performance and analytics cookies: Used to collect aggregated, anonymised data about how players interact with the Platform — such as pages visited, time on site, and error occurrences — for the purpose of improving Platform performance and user experience.
• Functional cookies: Used to remember your preferences such as language settings and responsible gaming tool configurations to provide a more personalised experience.

php889 does not use third-party advertising cookies, cross-site tracking pixels, or social media tracking technologies that would allow third parties to build advertising profiles based on your php889 activity.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect Platform functionality. Disabling performance or functional cookies will not prevent you from using the Platform but may reduce the quality of your experience.

8 Data Retention

php889 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account data and KYC records: Retained for a minimum of five (5) years from the date of account closure or last activity, in accordance with PAGCOR licensing requirements and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by AMLC regulations.
• Gameplay logs: Retained for a minimum of three (3) years for dispute resolution purposes, and thereafter deleted or anonymised.
• Customer support records: Retained for two (2) years from the date of resolution of the relevant inquiry or complaint.
• Marketing consent records: Retained for the duration of the consent and for a period of one (1) year after withdrawal, to evidence the history of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with php889's data disposal procedures.

9 Your Data Rights

As a data subject under RA 10173, you are entitled to the following rights in respect of your personal data held by php889. These rights may be exercised by contacting our Data Protection Officer as described in Section 14.

10 Children and Minors

The php889 Platform is strictly intended for individuals who are 21 years of age or older, consistent with the minimum legal age for casino-style gambling under Philippine law and PAGCOR regulations.

php889 does not knowingly collect personal data from individuals under 21 years of age. If php889 becomes aware that a minor has provided personal data or accessed the Platform, the account will be immediately suspended, all associated data will be deleted, and any funds held in the account will be handled in accordance with PAGCOR's applicable guidelines for underage account closures.

If you believe a minor may have created a php889 account, please contact our Data Protection Officer immediately at the contact details provided in Section 14.

11 Security Measures

php889 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• TLS encryption: All data transmitted between your device and php889's servers is encrypted using Transport Layer Security (TLS) protocols.
• Data encryption at rest: Sensitive personal data stored in php889's databases is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Personal data is accessible only to php889 personnel and authorised third-party processors with a documented need-to-know. Access is enforced through role-based access controls and multi-factor authentication for administrative systems.
• Payment data isolation: Full payment card details are never stored on php889 systems. Card processing is handled exclusively by our PCI DSS-compliant payment processor.
• Security monitoring: php889 operates continuous security monitoring and logging to detect and respond to anomalous activity, intrusion attempts, and potential data breaches.
• Employee training: All php889 personnel with access to personal data are subject to data protection training and are contractually bound by confidentiality obligations.

12 Cross-Border Data Transfers

php889 primarily processes personal data within the Philippines. However, some third-party service providers engaged by php889 — including game software providers and technical infrastructure providers — may be located outside the Philippines.

Where personal data is transferred to entities outside the Philippines, php889 ensures that appropriate safeguards are in place to maintain a level of data protection consistent with RA 10173. Such safeguards may include:

• Contractual data processing agreements incorporating data protection obligations equivalent to those required by Philippine law.
• Transfers to jurisdictions that have been assessed as providing an adequate level of personal data protection.
• Other lawful transfer mechanisms recognised by the National Privacy Commission.

You may request information about the specific safeguards in place for any cross-border transfer of your personal data by contacting our Data Protection Officer.

13 Amendments to This Policy

php889 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, php889 will:

• Update the effective date at the top of this Policy.
• Notify registered account holders via email to the address on file, and/or display a prominent notice within the Platform upon next login.
• Where required by RA 10173, obtain fresh consent from data subjects before implementing material changes to data processing purposes.

Continued use of the php889 Platform following the effective date of an amended Policy constitutes your acceptance of the updated terms. If you do not agree to the amended Policy, you may request account closure as described in the php889 Terms & Conditions.

The current version of this Policy is always accessible at php889.net/privacy-policy.

14 Contact and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights, please contact php889's Data Protection Officer:

• Data Protection Officer, php889
• Email: [email protected]
• Subject Line: Please include "Data Privacy Request" or "DPO Inquiry" in your subject line to ensure prompt routing to the correct team.
• Response Time: Acknowledgment within 72 hours; substantive response within 30 calendar days.

If you are unsatisfied with php889's response to your data privacy inquiry, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent authority responsible for enforcing RA 10173.