phtala.ph Privacy Policy

1 Introduction

phtala.ph ("phtala.ph", "we", "us", "our") operates the online gaming platform accessible at phtalaph.vip. As a personal information controller under Philippine law, phtala.ph is responsible for the personal data you provide to us or that we collect about you when you use our website, mobile application, or any related services.

This Privacy Policy applies to all users of the phtala.ph Platform, including registered account holders, visitors who browse without registering, and former account holders whose data we continue to hold under applicable retention obligations. By accessing the phtala.ph Platform, you acknowledge that you have read and understood this Privacy Policy.

phtala.ph also operates under PAGCOR regulatory requirements, which impose specific obligations regarding identity verification, anti-money laundering (AML) due diligence, and record-keeping. Some personal data processing described in this Policy is necessary to fulfil those regulatory obligations, and is not optional.

2 Personal Data We Collect

phtala.ph collects the following categories of personal data:

phtala.ph does not collect sensitive personal information as defined under RA 10173 (such as health information, political opinions, religious beliefs, or biometric data beyond KYC identity verification) unless specifically required for regulatory compliance and with your explicit consent where required by law.

3 How We Collect Personal Data

phtala.ph collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud prevention signals from anti-fraud partners; payment confirmation data from GCash, Maya, BPI, BDO, and other payment processors.
• PAGCOR and regulatory authorities: In limited circumstances, we may receive data from PAGCOR or other Philippine regulatory bodies in connection with compliance investigations or licensing requirements.

4 Legal Basis for Processing

Under the Data Privacy Act of 2012 and its IRR, phtala.ph processes your personal data on the following legal bases:

• Contractual necessity: Processing required to establish and manage your account, process transactions, and deliver the gaming services you have contracted for.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AML obligations under RA 9160, tax reporting obligations under the NIRC, and NPC requirements under RA 10173.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential analytics, where your consent has been freely given and can be withdrawn at any time without affecting your account standing.

5 How We Use Your Personal Data

phtala.ph uses your personal data for the following purposes:

• Creating, verifying, and managing your phtala.ph account.
• Processing deposits, withdrawals, and account balance management via GCash, Maya, and other supported Philippine payment methods.
• Conducting KYC and ongoing AML due diligence as required by PAGCOR and Philippine law.
• Delivering the gaming services you access through the Platform, including live dealer games, slots, sports betting, bingo, and fishing games.
• Detecting and preventing fraud, money laundering, identity theft, and other prohibited activities.
• Enforcing geographic restrictions and ensuring compliance with applicable laws.
• Administering bonuses, promotions, and loyalty programmes.
• Providing customer support and resolving disputes.
• Monitoring and enforcing responsible gaming obligations, including tracking self-exclusion status and deposit limit compliance.
• Sending transactional communications including OTPs, deposit/withdrawal confirmations, and security alerts.
• Sending promotional communications where you have consented or not objected where permitted by law.
• Improving the Platform through analytics and user experience research.

6 Data Sharing & Disclosure

phtala.ph does not sell your personal data to third parties. We share your personal data only in the following circumstances and only to the extent necessary for the stated purpose:

6.1 Service Providers (Personal Information Processors)

We engage third-party service providers to assist in operating the Platform, including KYC/identity verification providers, payment processors (including GCash and Maya operator entities), cloud hosting providers, cybersecurity and anti-fraud vendors, and customer support platform providers. These providers are contractually bound to process your data only on phtala.ph's instructions and in accordance with RA 10173.

6.2 Regulatory and Law Enforcement Authorities

phtala.ph will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), law enforcement agencies, and Philippine courts where required by law, court order, or in connection with the prevention and detection of crime or fraud.

6.3 Game Providers

Game providers whose titles are offered on the phtala.ph Platform may receive anonymised or pseudonymised session data necessary for game operation and RTP certification. Full identity data is not shared with game providers.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of phtala.ph's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations being imposed on the recipient.

7 Cookies & Tracking Technologies

The phtala.ph Platform uses cookies and similar tracking technologies to operate core Platform functions, maintain your login session, detect fraud, and — where you have consented — to understand how you use the Platform so we can improve it.

The types of cookies we use include:

• Strictly Necessary Cookies: Required for the Platform to function, including session management, security tokens, and authentication. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences (e.g., language, display settings) to provide a personalised experience.
• Analytics Cookies: Collect aggregated usage data to help us understand how the Platform is used and where improvements can be made. Deployed only with your consent.
• Security Cookies: Used for fraud detection, bot prevention, and to detect suspicious login activity across devices.

You can manage non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of certain parts of the phtala.ph Platform.

8 Data Retention

phtala.ph retains personal data for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Key retention periods include:

• Account and KYC data: Retained for the duration of your active account plus a minimum of five (5) years after account closure, as required by PAGCOR and AML regulations.
• Financial transaction records: Retained for a minimum of ten (10) years to meet BIR and AMLC record-keeping obligations.
• Gaming session logs: Retained for a minimum of five (5) years for regulatory audit and dispute resolution purposes.
• Responsible gaming records (including self-exclusion): Retained for the duration of the exclusion period plus five (5) years.
• Support communications: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained for three (3) years from the date consent was given or withdrawn.

When data is no longer required under any applicable retention obligation, phtala.ph will securely delete or anonymise it.

9 Data Security

phtala.ph implements technical and organisational measures appropriate to the risk level of the personal data we hold. These include:

• SSL/TLS encryption for all data transmitted between your device and phtala.ph servers.
• AES-256 encryption for stored sensitive data, including KYC documents and financial records.
• Hashing of passwords using industry-standard algorithms (bcrypt or equivalent); plaintext passwords are never stored.
• Two-factor authentication (2FA) for user accounts and administrative access.
• Role-based access controls limiting staff access to personal data on a need-to-know basis.
• Regular penetration testing and security audits by independent third parties.
• Incident response procedures aligned with NPC breach notification requirements under RA 10173.

In the event of a personal data breach that is likely to result in serious harm to affected data subjects, phtala.ph will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected users without undue delay in accordance with RA 10173.

10 Your Rights Under Philippine Law

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phtala.ph:

To exercise any of the above rights, please submit a written request to our Data Protection Officer at the contact details in Section 14. phtala.ph will respond within fifteen (15) working days from receipt of a complete request, as required by RA 10173.

11 Children & Minors

The phtala.ph Platform is strictly intended for persons aged 21 years and above. phtala.ph does not knowingly collect personal data from individuals under 21 years of age. Our KYC process is specifically designed to verify that all registered account holders meet this age requirement.

If phtala.ph becomes aware that personal data has been collected from an underage individual, the relevant account will be immediately suspended, the personal data will be deleted or anonymised (subject to any overriding regulatory retention obligation), and the matter will be reported to PAGCOR as required.

If you are a parent or guardian and believe your child has registered on the phtala.ph Platform, please contact our Data Protection Officer immediately using the details in Section 14.

12 International Data Transfers

Some of phtala.ph's service providers, including cloud hosting infrastructure and KYC verification vendors, may process personal data outside of the Philippines. Where such transfers occur, phtala.ph ensures that:

• The recipient country has been assessed to provide an adequate level of data protection; or
• Appropriate contractual safeguards (such as NPC-approved standard contractual clauses or binding corporate rules) are in place between phtala.ph and the recipient; and
• The transfer is limited to the minimum personal data necessary for the stated processing purpose.

You may request details of the safeguards applicable to any specific international transfer by contacting our Data Protection Officer.

13 Changes to This Privacy Policy

phtala.ph may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. When material changes are made, we will post a notice on the Platform and, where reasonably practicable, notify registered users by SMS or email.

The date of the most recent update is displayed at the top of this Policy. Your continued use of the phtala.ph Platform after the effective date of any revised Policy constitutes your acknowledgement of the updated terms. If you have material concerns about any update, you may request account closure and data deletion (subject to retention obligations) by contacting our support team.

14 Contact & Data Protection Officer

phtala.ph has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. To exercise your data rights, report a privacy concern, or make an inquiry about our data practices, please contact:

phtala.ph is committed to resolving all privacy-related concerns promptly and in good faith. If you remain unsatisfied after contacting our DPO, you have the right to lodge a complaint with the National Privacy Commission of the Philippines through their official website and complaint channels.