phpak Casino — Privacy Policy

1. Introduction

phpak Casino ("phpak", "we", "us", "our") is committed to protecting the privacy and personal data of every player who registers and plays on the phpak platform. This Privacy Policy ("Policy") describes how phpak collects, uses, stores, shares, and protects your personal information when you access or use the phpak website, mobile interface, games, and all related services (collectively, the "Platform").

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects phpak's obligations under PAGCOR's regulatory framework for licensed online gaming operators.

Please read this Policy carefully. By registering a phpak account or continuing to use the Platform, you acknowledge that you have read, understood, and agreed to the data practices described herein. If you do not agree, please discontinue use of the Platform and contact us to close your account.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, phpak Casino is the Personal Information Controller (PIC) in respect of all personal data collected through the Platform. phpak determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine privacy law.

phpak has designated a Data Protection Officer (DPO) who is responsible for overseeing data protection compliance and handling data subject requests. Contact details for the DPO are provided in Section 16 of this Policy.

3. Personal Data We Collect

phpak collects the following categories of personal data from players and platform visitors:

phpak does not intentionally collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. Where sensitive information is collected (e.g., a copy of a government ID), it is handled with heightened security measures and access controls.

4. How We Collect Your Data

phpak collects personal data through the following means:

• Direct collection: Information you provide when registering a phpak account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and session activity logs via cookies and similar technologies.
• Third-party sources: Identity verification data from PAGCOR-approved KYC service providers; fraud and AML screening data from compliance partners; payment data from GCash, Maya, and Philippine banking partners.
• Regulatory sources: Information received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine government agencies in connection with phpak's legal obligations.

5. How We Use Your Personal Data

phpak uses your personal data for the following purposes:

• To create, verify, and manage your phpak player account.
• To process deposits, withdrawals, and all financial transactions on the Platform.
• To verify your identity and age (21+) in compliance with PAGCOR regulations and the Data Privacy Act.
• To comply with Anti-Money Laundering (AML) obligations under Republic Act No. 9160 and its amendments, including reporting to the AMLC where required.
• To detect, investigate, and prevent fraud, cheating, collusion, and other prohibited conduct on the Platform.
• To provide customer support and respond to your enquiries, complaints, and feedback.
• To send you transactional communications related to your phpak account, including deposit confirmations, withdrawal notifications, and security alerts.
• To send you promotional communications about phpak bonuses and offers, where you have provided consent or where permitted by applicable law. You may opt out at any time.
• To monitor and enforce responsible gaming obligations, including administering self-exclusion requests and deposit limits.
• To improve the phpak Platform, analyse usage patterns, and develop new features and games.
• To comply with all applicable Philippine laws, regulations, and PAGCOR licensing conditions.

6. Legal Basis for Processing

phpak processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and phpak — i.e., to operate your account, process transactions, and deliver gaming services.
• Legal obligation: Processing required to comply with PAGCOR regulations, AML laws, tax obligations, and other applicable Philippine legal requirements.
• Legitimate interests: Processing necessary for phpak's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing & Disclosure

phpak does not sell, rent, or trade your personal data to third parties for commercial purposes. phpak may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• PAGCOR and Philippine regulatory authorities: As required by phpak's gaming licence and applicable Philippine law.
• Anti-Money Laundering Council (AMLC): For mandatory suspicious transaction reporting and compliance with RA 9160.
• Payment service providers: GCash, Maya, and Philippine banking partners, solely to process your deposits and withdrawals.
• KYC and identity verification providers: PAGCOR-approved third-party services used to verify your identity and age.
• Game content providers: Third-party game studios whose games are hosted on the phpak Platform may receive anonymised session data for technical and licensing purposes.
• IT and security service providers: Cloud hosting, cybersecurity, and fraud detection partners who process data on phpak's behalf under strict data processing agreements.
• Legal and professional advisers: Lawyers, auditors, and compliance consultants engaged by phpak, subject to professional confidentiality obligations.
• Law enforcement and courts: Where phpak is required by law, court order, or regulatory direction to disclose personal data.

8. International Data Transfers

Some of phpak's service providers and game content partners may be located outside the Philippines. Where personal data is transferred to a country that does not provide an equivalent level of data protection to the Philippines, phpak will implement appropriate safeguards, which may include:

• Standard contractual clauses approved by the National Privacy Commission.
• Binding corporate rules where the recipient is part of the same corporate group.
• Your explicit consent to the transfer, where required.

phpak will not transfer your personal data internationally unless a lawful basis and appropriate safeguards are in place. You may request information about the specific safeguards applicable to any international transfer by contacting our DPO.

9. Data Retention

phpak retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your phpak account and for a minimum of five (5) years after account closure, as required by PAGCOR licensing conditions and AML regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with RA 9160 and applicable tax regulations.
• KYC and verification documents: Retained for the duration of your account and for five (5) years after closure, or longer if required by a regulatory investigation or legal proceeding.
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• Support communications: Retained for two (2) years from the date of the last interaction, unless the matter relates to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your consent and for one (1) year after withdrawal of consent, as evidence of lawful processing.

When personal data is no longer required, phpak will securely delete or anonymise it in accordance with NPC-approved data disposal procedures.

10. Cookies & Tracking Technologies

phpak uses cookies and similar tracking technologies on the Platform to ensure proper functionality, maintain session security, and analyse platform performance. The following types of cookies are used:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in to your phpak account. These cannot be disabled without affecting Platform functionality.
• Performance cookies: Used to collect anonymised data about how players use the phpak Platform — such as which pages are visited most frequently — to help us improve the user experience. No personally identifiable information is collected by these cookies.
• Security cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats on the phpak Platform.
• Preference cookies: Used to remember your language and display preferences so you do not need to reset them on each visit.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may prevent you from accessing certain features of the phpak Platform, including your account login.

11. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phpak:

• Right to be informed: The right to know that your personal data is being collected and processed, and to receive clear information about how it is used — as provided in this Policy.
• Right of access: The right to request a copy of the personal data phpak holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data phpak holds about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to phpak's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on phpak's legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to request its transfer to another controller where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phpak has violated your data privacy rights.

To exercise any of the above rights, please submit a written request to phpak's Data Protection Officer at the contact details provided in Section 16. phpak will respond to all verified data subject requests within fifteen (15) business days of receipt. phpak may request proof of identity before processing your request to protect against unauthorised access to your data.

12. Children's Privacy

The phpak Platform is strictly intended for individuals aged 21 years and above, as required by PAGCOR regulations governing casino-style online gaming in the Philippines. phpak does not knowingly collect personal data from individuals under the age of 21.

If phpak discovers or has reason to believe that personal data has been collected from a person under 21 years of age, phpak will immediately suspend the relevant account, delete the associated personal data, and report the matter to PAGCOR as required by its licensing conditions.

If you are a parent or guardian and believe that your child under 21 has registered a phpak account or provided personal data to phpak, please contact our support team immediately at the details provided in Section 16 so that we can take prompt action.

13. Security Measures

phpak implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phpak's servers.
• Encryption at rest for sensitive personal and financial data stored on phpak's servers.
• Multi-factor authentication (MFA) options for phpak player accounts to prevent unauthorised access.
• Role-based access controls ensuring that phpak staff can only access personal data necessary for their specific job function.
• Regular security audits and penetration testing conducted by independent cybersecurity professionals.
• Intrusion detection and prevention systems monitoring phpak's infrastructure for suspicious activity in real time.
• Staff training on data privacy obligations and secure data handling practices under the Data Privacy Act of 2012.

While phpak takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. You are responsible for keeping your phpak login credentials confidential and for notifying phpak immediately if you suspect any unauthorised access to your account.

14. Third-Party Links

The phpak Platform may contain links to third-party websites or services, such as payment provider portals (GCash, Maya) or PAGCOR's official website. These third-party sites operate independently of phpak and are governed by their own privacy policies. phpak is not responsible for the privacy practices or content of any third-party website.

phpak encourages you to review the privacy policy of any third-party site you visit before providing any personal information. The inclusion of a link on the phpak Platform does not constitute an endorsement of the linked site's privacy practices.

15. Updates to This Privacy Policy

phpak reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, PAGCOR regulations, or NPC guidance. When material changes are made, phpak will notify registered players by email or through a prominent notice on the Platform at least seven (7) days before the changes take effect, where practicable.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. The current version of this Privacy Policy is always available at phpak.net/privacy-policy. Your continued use of the phpak Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

If you have concerns about any changes to this Policy, please contact our Data Protection Officer before the effective date of the amendment. If you do not agree with the revised Policy, you may request account closure by contacting our support team.

16. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by phpak, please contact our Data Protection Officer through the following channel:

If you are not satisfied with phpak's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the government body responsible for administering and enforcing the Data Privacy Act of 2012.

For responsible gaming concerns, including self-exclusion requests, please visit our Responsible Gaming page or contact our support team directly. phpak is committed to handling all player data with the utmost care, transparency, and respect.