phtaa Privacy
Policy

phtaa ("phtaa", "we", "us", "our") operates the online gaming platform accessible at phtaa.net and through the phtaa mobile application. In the course of providing our services to registered players in the Philippines, phtaa collects and processes personal data about those players and, in some cases, about individuals who visit the phtaa platform without registering.

This Privacy Policy applies to all personal data collected and processed by phtaa in connection with the phtaa platform, including data collected during registration, during gameplay, during financial transactions, and through your interactions with phtaa's customer support team.

This Privacy Policy should be read alongside phtaa's Terms and Conditions and Responsible Gaming Policy, both of which are available on the phtaa platform. By registering an account or using the phtaa platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations, phtaa is the personal information controller in respect of the personal data collected and processed through the phtaa platform.

phtaa has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with RA 10173 and this Privacy Policy. Contact details for the phtaa DPO are provided in Section 16 of this policy.

Where phtaa engages third-party service providers to process personal data on its behalf, those providers act as personal information processors and are bound by data processing agreements that require them to process personal data only in accordance with phtaa's instructions and in compliance with applicable Philippine data protection law.

phtaa collects the following categories of personal data about registered players and platform visitors:

phtaa does not intentionally collect sensitive personal information as defined under RA 10173 (such as health data, political opinions, or religious beliefs) unless specifically required for regulatory compliance purposes, in which case your explicit consent will be obtained.

phtaa collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account settings.
• Automated collection: Technical and usage data collected automatically when you access the phtaa platform, including through cookies, web beacons, and server logs. See Section 8 for more detail on cookies.
• Third-party sources: Identity and fraud-check data received from KYC verification service providers, payment processors, and fraud prevention partners where permitted by applicable law.
• Regulatory sources: Information received from regulatory authorities or law enforcement agencies in connection with legal obligations or investigations.

phtaa will always inform you at the point of collection if providing certain personal data is mandatory for the use of a particular feature or service. Where providing data is optional, this will also be made clear.

phtaa processes your personal data on the following legal bases as recognised under the Philippine Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between you and phtaa — including account management, payment processing, and game operation — is carried out on the basis that it is necessary for the performance of that contract.
• Legal obligation: Processing required to comply with phtaa's legal and regulatory obligations, including anti-money laundering (AML) requirements, age verification obligations, and reporting obligations to relevant Philippine authorities.
• Legitimate interests: Processing carried out for phtaa's legitimate business interests, including fraud prevention, platform security, and improving the phtaa platform, where those interests are not overridden by your rights and interests.
• Consent: Where phtaa relies on your consent as the legal basis for processing — for example, for direct marketing communications — you may withdraw that consent at any time by contacting phtaa support or updating your account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

phtaa uses the personal data it collects for the following purposes:

• To create and manage your phtaa account, including verifying your identity and age as required by Philippine regulations.
• To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods.
• To operate and deliver the phtaa game library, including Ocean King Jackpot, Ganesh Fortune, Money Wheel, Lucky Piggy, Dice, Midas Fortune, and Fishing.
• To detect, investigate, and prevent fraudulent activity, money laundering, and other illegal conduct on the phtaa platform.
• To comply with phtaa's legal and regulatory obligations under Philippine law, including reporting obligations to relevant authorities.
• To administer bonuses, promotions, and loyalty programmes in accordance with their applicable terms.
• To provide customer support and resolve complaints and disputes.
• To send you transactional communications relating to your account, including deposit confirmations, withdrawal notifications, and security alerts.
• To send you marketing communications about phtaa promotions and new games, where you have consented to receive such communications.
• To monitor and enforce responsible gaming obligations, including administering deposit limits, session limits, and self-exclusion requests.
• To analyse platform usage and improve the phtaa user experience.

phtaa does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phtaa may share your personal data with the following categories of recipients, strictly for the purposes described in this Privacy Policy:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing your deposits and withdrawals. These providers receive only the data necessary to complete the relevant transaction.
• KYC and identity verification providers: Third-party identity verification services used to verify your identity and age as required by Philippine regulations. These providers process your identity documents and personal data under strict data processing agreements.
• Fraud prevention and AML service providers: Third-party services used to detect and prevent fraudulent activity and money laundering on the phtaa platform.
• Technology and infrastructure providers: Cloud hosting, data storage, and platform infrastructure providers who process data on phtaa's behalf under data processing agreements.
• Customer support providers: Third-party customer support platforms used to manage live chat and email support interactions.
• Regulatory and law enforcement authorities: Philippine government agencies, regulatory bodies, and law enforcement authorities where phtaa is required by law to disclose personal data, or where disclosure is necessary to protect the rights, property, or safety of phtaa, its players, or the public.
• Professional advisers: Legal, accounting, and auditing firms engaged by phtaa, subject to professional confidentiality obligations.

All third-party service providers engaged by phtaa are required to implement appropriate technical and organisational security measures to protect your personal data and to process it only in accordance with phtaa's instructions.

The phtaa platform uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse how the platform is used. A cookie is a small text file placed on your device when you visit the phtaa platform.

phtaa uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the phtaa platform to function. They enable core features such as account login, session management, and security. These cookies cannot be disabled.
• Functional cookies: These cookies remember your preferences and settings, such as your preferred language and responsible gaming settings, to provide a more personalised experience.
• Analytics cookies: These cookies collect anonymised information about how players use the phtaa platform, such as which pages are visited most frequently and how long sessions last. This data is used to improve the platform.
• Security cookies: These cookies help phtaa detect and prevent fraudulent activity, including detecting unusual login patterns and suspicious account behaviour.

You can control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the phtaa platform. Strictly necessary and security cookies cannot be disabled as they are required for the platform to operate securely.

phtaa retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The following retention periods apply to the main categories of personal data held by phtaa:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with Philippine AML regulations and gaming regulatory requirements.
• Financial transaction data: Retained for a minimum of 5 years following the date of the transaction, in accordance with Philippine financial record-keeping requirements.
• Gaming history data: Retained for a minimum of 3 years following the date of the relevant gaming session, for regulatory compliance and dispute resolution purposes.
• Customer support communications: Retained for 2 years following the resolution of the relevant support interaction or complaint.
• Technical and usage data: Retained for up to 12 months, after which it is anonymised or deleted.
• Marketing consent records: Retained for the duration of your account and for 2 years following account closure or withdrawal of consent.

Where phtaa is required by law to retain personal data for a longer period, the legally required retention period will apply. At the end of the applicable retention period, personal data is securely deleted or anonymised.

phtaa implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption of personal data in transit using TLS (Transport Layer Security) protocols.
• Encryption of sensitive personal data at rest, including financial data and identity documents.
• Access controls limiting access to personal data to authorised phtaa personnel and service providers on a need-to-know basis.
• Regular security assessments and penetration testing of the phtaa platform.
• Multi-factor authentication requirements for administrative access to systems holding personal data.
• Incident response procedures for detecting, reporting, and responding to personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phtaa will notify the National Privacy Commission (NPC) and affected players in accordance with the requirements of RA 10173 and its implementing rules.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by phtaa:

To exercise any of these rights, please contact phtaa's Data Protection Officer using the contact details in Section 16. phtaa will respond to all data rights requests within 15 business days. In some cases, phtaa may need to verify your identity before processing your request.

Please note that certain rights are subject to limitations under RA 10173 — for example, phtaa may be required to retain certain data for regulatory compliance purposes even where a deletion request is received.

The phtaa platform is strictly intended for individuals who are 21 years of age or older. phtaa does not knowingly collect personal data from individuals under the age of 21. The minimum age requirement is enforced through phtaa's KYC verification process, which requires all players to provide documentary proof of age before accessing real-money play.

If phtaa becomes aware that personal data has been collected from an individual under the age of 21, phtaa will immediately suspend the relevant account, delete the personal data collected, and return any deposits made in accordance with applicable law.

If you are a parent or guardian and believe that your child has registered on the phtaa platform, please contact phtaa support immediately using the contact details in Section 16.

In some cases, phtaa may transfer your personal data to service providers or infrastructure partners located outside the Philippines. Where such transfers occur, phtaa ensures that appropriate safeguards are in place to protect your personal data in accordance with the requirements of RA 10173 and its implementing rules.

Safeguards for cross-border transfers may include contractual clauses approved by the National Privacy Commission, adequacy determinations, or other legally recognised transfer mechanisms. phtaa will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without implementing appropriate safeguards.

You may request information about the specific safeguards in place for any cross-border transfer of your personal data by contacting phtaa's Data Protection Officer.

The phtaa platform does not contain links to third-party websites or services for advertising or affiliate purposes. All links within the phtaa platform direct to internal phtaa pages only.

This Privacy Policy applies solely to personal data collected and processed by phtaa through the phtaa platform. phtaa is not responsible for the privacy practices of any third-party services you may access independently outside of the phtaa platform.

phtaa may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable Philippine law, or improvements to the phtaa platform. The effective date of the current version of this Privacy Policy is stated at the top of this page.

When material changes are made to this Privacy Policy, phtaa will notify registered players via email to their registered email address and/or via a prominent notice on the phtaa platform. Where required by law, phtaa will seek your consent before implementing material changes to the way your personal data is processed.

Your continued use of the phtaa platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with any changes to this Privacy Policy, you should stop using the phtaa platform and may close your account in accordance with phtaa's Terms and Conditions.

If you have any questions about this Privacy Policy, wish to exercise your data rights under RA 10173, or wish to raise a data privacy concern, please contact phtaa's Data Protection Officer using the following details:

• Data Protection Officer: phtaa Data Privacy Team
• Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the phtaa platform

phtaa will acknowledge all data privacy requests within 5 business days and will provide a full response within 15 business days. Where a request is complex or involves a large volume of data, phtaa may extend this period by a further 15 business days, in which case you will be notified of the extension and the reason for it.

If you are not satisfied with phtaa's response to your data privacy request or complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about how to contact the NPC is available on the NPC's official website.