phcaah Privacy Policy

1. Overview and Scope

This Privacy Policy ("Policy") is issued by phcaah ("phcaah," "we," "us," or "our") and applies to all personal data collected, processed, stored, and used in connection with your access to and use of the phcaah website, mobile platform, games, and all related services (collectively, the "Platform").

This Policy applies to all registered players, visitors, and any other individuals whose personal data phcaah processes in connection with the Platform, regardless of whether they are located in Metro Manila, Cebu, Davao, Quezon City, Makati, or any other part of the Philippines.

phcaah acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes. Where phcaah engages third-party service providers to process personal data on its behalf, those providers act as Personal Information Processors (PIPs) and are bound by data processing agreements that require them to maintain standards consistent with this Policy and RA 10173.

2. Personal Data We Collect

phcaah collects the following categories of personal data in connection with the operation of the Platform:

2.1 Identity and Registration Data

• Full legal name as it appears on your government-issued identification
• Date of birth (used to verify the 21+ age requirement under Philippine gambling regulations)
• Gender
• Nationality and country of residence
• Government-issued identification numbers (e.g., Philippine passport number, SSS/UMID number, driver's licence number) — collected during KYC verification only

2.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including barangay, city/municipality, province, and postal code)

2.3 Financial Data

• GCash or PayMaya account details (mobile number associated with the account)
• Bank account details for BPI, BDO, Metrobank, or other linked bank accounts (account name and number only)
• Transaction history, including deposit amounts, withdrawal amounts, dates, and payment method used
• Wagering history and game activity records

2.4 Technical and Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session duration, pages visited, and features used on the Platform
• Login timestamps and access logs
• Cookie identifiers and similar tracking technologies (see Section 9)

2.5 Communications Data

• Records of your communications with phcaah's customer support team, including live chat transcripts and email correspondence
• Feedback, survey responses, and promotional opt-in preferences

3. How We Collect Your Data

phcaah collects personal data through the following means:

4. How phcaah Uses Your Data

phcaah processes your personal data for the following specific, legitimate purposes:

• Account Management: To create, maintain, and administer your phcaah account, including verifying your identity and eligibility to use the Platform.
• Age Verification: To confirm that you meet the 21+ age requirement mandated by Philippine gambling regulations before granting access to real-money gaming features.
• Payment Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment channels, and to maintain accurate financial records.
• KYC and AML Compliance: To verify your identity and the source of your funds in compliance with the Philippine Anti-Money Laundering Act (AMLA) and PAGCOR regulatory requirements.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the Platform.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance with your phcaah account.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling and to administer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion.
• Marketing and Promotions: To send you promotional offers, bonus notifications, and platform updates, where you have provided your consent or where phcaah has a legitimate interest in doing so. You may opt out of marketing communications at any time.
• Platform Improvement: To analyse usage patterns, conduct research, and improve the features, performance, and user experience of the phcaah Platform.
• Legal Compliance: To comply with applicable Philippine laws, regulations, court orders, and lawful requests from government authorities including PAGCOR and the Anti-Money Laundering Council (AMLC).

5. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 (RA 10173), phcaah processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and phcaah (i.e., the Terms and Conditions), including account management, payment processing, and game delivery.
• Legal Obligation: Processing is required to comply with phcaah's legal obligations under Philippine law, including AMLA compliance, PAGCOR regulatory requirements, and tax reporting obligations.
• Legitimate Interests: Processing is necessary for phcaah's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, provided those interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and non-essential cookies, phcaah relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing and Disclosure

phcaah does not sell, rent, or trade your personal data. phcaah may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: GCash (Mynt), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, and other payment processors, solely for the purpose of processing your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and identity verification service providers engaged to assist phcaah in verifying player identities and complying with AML obligations.
• Game Software Providers: Licensed game studios and live dealer platform providers whose games are available on phcaah. These providers may receive limited technical data necessary to deliver their games.
• Fraud Prevention and Security Providers: Third-party fraud detection and cybersecurity service providers engaged to protect the integrity of the phcaah Platform.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law or regulation.
• Professional Advisers: Legal counsel, auditors, and other professional advisers engaged by phcaah, subject to professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of phcaah's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections as set out in this Policy.

7. Data Retention

phcaah retains your personal data for the periods set out below, after which data is securely deleted or anonymised:

Where phcaah is required by law to retain data for longer periods, the statutory retention period will prevail. Upon expiry of the applicable retention period, phcaah will securely delete or irreversibly anonymise your personal data.

8. Data Security

phcaah implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption: All data transmitted between your device and phcaah's servers is encrypted using TLS (Transport Layer Security) 1.2 or higher. Sensitive data at rest, including financial records and KYC documents, is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted to phcaah personnel and authorised third-party processors who require it to perform their duties. Role-based access controls and multi-factor authentication are enforced for all internal systems.
• Security Monitoring: phcaah employs continuous security monitoring, intrusion detection systems, and regular vulnerability assessments to identify and address potential security threats.
• Data Breach Response: phcaah maintains a documented data breach response plan. In the event of a personal data breach that poses a real risk of serious harm, phcaah will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with NPC Circular 16-03.
• Staff Training: All phcaah personnel who handle personal data receive regular data privacy and security training.
• Third-Party Security: phcaah conducts due diligence on all third-party processors and requires them to maintain security standards consistent with RA 10173 and this Policy.

9. Cookies and Tracking Technologies

phcaah uses cookies and similar tracking technologies to enhance your experience on the Platform, analyse usage patterns, and support security and fraud prevention functions. The following types of cookies are used:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may affect the functionality of the phcaah Platform. phcaah does not use cookies to serve third-party advertising.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by phcaah. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.

phcaah will respond to all data subject rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with notice provided to you.

11. Minors and Age Restriction

The phcaah Platform is strictly intended for individuals aged 21 years and above, in accordance with Philippine gambling regulations. phcaah does not knowingly collect personal data from individuals under the age of 21.

Parents and guardians are encouraged to use parental control tools and to monitor the online activities of minors in their care to prevent access to gambling platforms.

12. Cross-Border Data Transfers

phcaah primarily processes personal data within the Republic of the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines, including game software providers and cloud infrastructure providers.

Where such cross-border transfers occur, phcaah ensures that appropriate safeguards are in place to protect your personal data, in accordance with Section 21 of RA 10173 and NPC guidelines on cross-border data transfers. These safeguards may include:

• Contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under RA 10173;
• Transfers to countries or organisations that the NPC has determined provide an adequate level of data protection; or
• Your explicit consent to the transfer, where required.

You may request information about the specific safeguards applicable to any cross-border transfer of your personal data by contacting our Data Protection Officer.

13. Changes to This Privacy Policy

phcaah reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The following process applies to material changes:

• Material changes to this Policy will be communicated to registered players via email to the address on their phcaah account, and/or via a prominent notice on the Platform, at least seven (7) days prior to the changes taking effect.
• The "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent amendment.
• Your continued use of the phcaah Platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the revised Policy, you should cease using the Platform and may request account closure.
• For non-material changes (such as typographical corrections or clarifications that do not alter the substance of the Policy), phcaah may update the Policy without prior notice.

We encourage you to review this Privacy Policy periodically to stay informed of how phcaah protects your personal data.

14. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phcaah's data processing practices, or if you wish to exercise any of your data subject rights under RA 10173, please contact our Data Protection Officer:

This Privacy Policy was last reviewed and updated on January 1, 2026. phcaah reserves all rights not expressly granted in this Policy.