phaa Privacy Policy

1 Introduction

phaa ("we," "us," "our," or "the Platform") is an online gaming platform serving players in the Republic of the Philippines. We are committed to protecting the privacy and personal data of every player who registers and plays on phaa. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of personal information in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines.

This policy applies to all personal data collected through the phaa website at phaa.app, including all games, promotions, support interactions, and payment transactions conducted through the Platform. It applies to all registered players, prospective players who browse the Platform, and any individual whose personal data phaa processes in connection with its services.

This Privacy Policy should be read alongside phaa's Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2 Personal Data We Collect

phaa collects personal data that is necessary to provide our services, comply with legal obligations, and maintain the security and integrity of the Platform. The categories of personal data we collect include:

phaa does not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where strictly required by law (for example, problem gambling self-declaration for responsible gaming purposes).

3 How We Collect Your Data

phaa collects personal data through the following channels:

• Direct Registration: When you create a phaa account, you provide your name, date of birth, email address, and Philippine mobile number directly to us.
• KYC Verification: When you submit identity documents (passport, SSS ID, PhilHealth ID, driver's license) and proof of address to complete account verification.
• Payment Transactions: When you make deposits or request withdrawals via GCash, PayMaya, BPI, BDO, or Metrobank, your payment provider shares transaction data with phaa.
• Platform Usage: Automatically collected as you browse and play on phaa, including IP address, device identifiers, session data, and game activity logs.
• Customer Support: When you contact phaa via live chat or email, we record the content of those communications.
• Cookies and Tracking Technologies: As described in Section 7 of this policy.
• Third-Party Sources: In limited circumstances, phaa may receive data from fraud prevention agencies, identity verification providers, or payment processors to supplement our own records.

4 How We Use Your Personal Data

phaa uses your personal data for the following purposes:

• Account Management: To create, maintain, and administer your phaa player account, including processing your registration and verifying your identity.
• Service Delivery: To provide access to games, process deposits and withdrawals, and deliver the full range of phaa gaming services.
• Legal and Regulatory Compliance: To comply with PAGCOR licensing requirements, the Data Privacy Act of 2012, Anti-Money Laundering Act (AMLA), and other applicable Philippine laws. This includes mandatory KYC verification and transaction monitoring.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, and other illegal conduct on the Platform.
• Responsible Gaming: To monitor gaming patterns, identify players who may be at risk of problem gambling, and enforce self-exclusion requests and deposit limits.
• Customer Support: To respond to your inquiries, resolve disputes, and improve the quality of our support services.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have given your consent or where we have a legitimate interest in doing so. You may opt out at any time.
• Platform Improvement: To analyze usage patterns, conduct A/B testing, and improve the performance, design, and features of the phaa Platform.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012, phaa processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and phaa — specifically, to provide gaming services, process payments, and manage your account.
• Legal Obligation: Processing is required to comply with applicable Philippine laws, including PAGCOR regulations, AMLA obligations, and NPC data privacy requirements.
• Legitimate Interests: phaa processes certain data (such as technical and security data) based on our legitimate interest in maintaining platform security, preventing fraud, and improving our services — provided these interests are not overridden by your privacy rights.
• Consent: For marketing communications and non-essential cookies, phaa relies on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing and Disclosure

phaa does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

• Game Providers: Third-party game developers whose games are hosted on phaa may receive limited gameplay data necessary to deliver their services. All game providers are contractually bound to handle your data in accordance with applicable privacy laws.
• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers receive the financial data necessary to process your transactions. These providers operate under their own privacy policies and are regulated by the Bangko Sentral ng Pilipinas (BSP).
• Identity Verification Providers: Third-party KYC and identity verification services may process your identity documents on phaa's behalf to fulfill our regulatory obligations.
• Regulatory Authorities: phaa is required by law to disclose certain data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies upon lawful request.
• Fraud Prevention Agencies: In cases of suspected fraud, money laundering, or other illegal activity, phaa may share relevant data with law enforcement agencies and fraud prevention organizations.
• Professional Advisors: phaa's legal counsel, auditors, and compliance consultants may access personal data on a need-to-know basis, subject to strict confidentiality obligations.

All third parties with whom phaa shares personal data are required to implement appropriate technical and organizational security measures and to process data only for the specified purpose.

7 Cookies and Tracking Technologies

phaa uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain session security, and analyze usage patterns. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Performance Cookies: Collect anonymized data about how players use phaa — which pages are visited most, how long sessions last, and where errors occur. This data helps us improve the Platform.
• Functional Cookies: Remember your preferences, such as language settings and game display options, to provide a more personalized experience.
• Analytics Cookies: Used to understand aggregate player behavior and measure the effectiveness of our features and promotions. Data collected is anonymized and aggregated.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the phaa Platform. Strictly necessary cookies cannot be disabled as they are required for the Platform to operate securely.

8 Data Retention

phaa retains your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account Data: Retained for the duration of your active account plus five (5) years after account closure, in accordance with PAGCOR record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act.
• KYC Documents: Retained for five (5) years after account closure or the last transaction, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the interaction.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which it is deleted within 30 days.
• Technical and Log Data: Retained for up to twelve (12) months for security and fraud prevention purposes.

Upon expiry of the applicable retention period, phaa will securely delete or anonymize your personal data in accordance with our data disposal procedures.

9 Data Security

phaa implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Our security measures include:

• SSL/TLS Encryption: All data transmitted between your device and phaa servers is encrypted using Transport Layer Security (TLS) protocols.
• Data Encryption at Rest: Sensitive personal and financial data stored on phaa servers is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized phaa personnel on a strict need-to-know basis. All staff with access to personal data undergo regular privacy and security training.
• Two-Factor Authentication: phaa supports two-factor authentication (2FA) via your registered Philippine mobile number to protect your account from unauthorized access.
• Regular Security Audits: phaa conducts regular penetration testing and security audits to identify and remediate vulnerabilities.
• Incident Response: In the event of a personal data breach, phaa will notify affected players and the National Privacy Commission within 72 hours of becoming aware of the breach, as required by the Data Privacy Act.

While phaa takes all reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your phaa login credentials and for notifying us immediately if you suspect unauthorized access to your account.

10 Your Data Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phaa:

To exercise any of these rights, please contact phaa's Data Protection Officer at [email protected]. We will respond to all verified requests within fifteen (15) business days. We may need to verify your identity before processing your request.

11 Children's Privacy

The phaa Platform is strictly intended for individuals aged 21 years and above, in accordance with Philippine law and PAGCOR regulations governing casino-style gambling. phaa does not knowingly collect personal data from individuals under the age of 21.

If phaa discovers that personal data has been collected from a person under 21, we will immediately suspend the associated account, delete the data, and report the incident to the appropriate regulatory authorities. If you are a parent or guardian and believe your child has registered on phaa, please contact us immediately at [email protected].

12 International Data Transfers

phaa primarily stores and processes personal data within the Republic of the Philippines. However, some of our third-party service providers — including game developers, cloud infrastructure providers, and fraud prevention services — may be located outside the Philippines.

Where personal data is transferred outside the Philippines, phaa ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require the recipient to apply data protection standards equivalent to those required under the Data Privacy Act of 2012. phaa will not transfer your personal data to countries that do not provide an adequate level of data protection without your explicit consent or without implementing appropriate safeguards.

13 Updates to This Privacy Policy

phaa reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory requirements. Material changes will be communicated to registered players via email or through a prominent notice on the Platform. The "Effective Date" at the top of this document will be updated to reflect the date of the most recent revision.

Your continued use of the phaa Platform following the posting of an updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this policy periodically to stay informed about how phaa protects your personal data.

14 Contact Us and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phaa's data processing practices, please contact our Data Protection Officer:

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24/7 via the phaa Platform

If you are not satisfied with phaa's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the government body responsible for enforcing the Data Privacy Act of 2012 and protecting the privacy rights of Filipino citizens.