phhoy Privacy Policy

1Introduction

1.1 This Privacy Policy ("Policy") describes how phhoy, the operator of the online gaming platform at phhoy.cam, collects, uses, stores, discloses, and protects the personal information of individuals ("Players," "Users," "you") who access or use the phhoy platform.

1.2 phhoy operates exclusively for the Philippine market. This Policy is written in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, and reflects the data protection standards expected of online gaming operators serving Filipino players.

1.3 This Policy should be read in conjunction with phhoy's Terms & Conditions, which form part of the overall agreement between you and phhoy. In the event of any conflict between this Policy and the Terms & Conditions regarding data handling, this Policy shall prevail.

1.4 This Policy applies to all personal data collected through: (a) your registration and use of the phhoy platform; (b) your communications with phhoy customer support; (c) your use of phhoy's payment channels including GCash, Maya, and bank transfers; and (d) your participation in phhoy promotions and loyalty programs.

2Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can be used to identify a natural person, either directly or in combination with other data, including but not limited to name, mobile number, email address, date of birth, and government ID details.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and erasure.
• "Data Subject" means the natural person (i.e., the Player or User) to whom Personal Data relates.
• "Data Controller" means phhoy, which determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of phhoy under a contractual obligation.
• "Sensitive Personal Information" has the same meaning as defined in Section 3(l) of RA 10173, which includes government-issued ID numbers and financial account information.
• "NPC" means the National Privacy Commission of the Philippines.
• "DPA" means the Data Privacy Act of 2012 (Republic Act No. 10173).

3Personal Data We Collect

3.1 phhoy collects Personal Data through several channels. The categories of data we collect and the circumstances under which they are collected are set out below.

3.2 Registration Data

When you create a phhoy account, we collect: full legal name; date of birth; Philippine residential address; registered mobile number (Globe, Smart, or DITO); and email address. This data is required to create and maintain your account.

3.3 KYC Identity Data

Before processing your first withdrawal, phhoy requires KYC identity verification. This involves collection of: photographic images of your Philippine government-issued identification document; a real-time selfie photograph; and, in some cases, proof of address documentation. The specific IDs accepted by phhoy are listed in the Terms & Conditions.

3.4 Financial Transaction Data

We collect records of all deposits, withdrawals, and gaming transactions conducted through your phhoy account, including GCash reference numbers, Maya transaction IDs, bank transfer references, transaction amounts, timestamps, and payment method identifiers. We do not store full bank account or card numbers — only the reference identifiers necessary for transaction reconciliation.

3.5 Gaming Activity Data

phhoy records your gaming activity, including: games accessed; wager amounts; session durations; win and loss records; and responsible gaming limit settings. This data is used for account administration, regulatory compliance, and responsible gaming monitoring.

3.6 Technical & Device Data

When you access the phhoy platform, we automatically collect: IP address; device type and model; operating system version; browser type and version; session timestamps; and referring URL. This data is used for security monitoring, fraud prevention, and platform performance optimization.

3.7 Communications Data

Records of your communications with phhoy customer support — including live chat transcripts, email correspondence, and support ticket records — are retained for quality assurance, dispute resolution, and regulatory audit purposes.

4How We Use Your Personal Data

4.1 phhoy uses Personal Data collected from you for the following purposes:

4.2 phhoy does not use automated decision-making processes that produce legal effects on Players without human review. Responsible gaming limit interventions are reviewed by phhoy's responsible gaming team before being applied to accounts.

5Legal Basis for Processing

5.1 phhoy processes Personal Data only where a valid legal basis exists under the Philippine Data Privacy Act. The legal bases applicable to phhoy's data processing activities are:

• Contract Performance: Processing necessary to deliver the gaming services you have contracted for, including account management, payment processing, and game access.
• Legal Obligation: Processing required to comply with Philippine law, including KYC/AML requirements, regulatory reporting, age verification, and responses to lawful authority requests.
• Legitimate Interests: Processing necessary for phhoy's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics — provided those interests do not override your rights.
• Consent: Processing for optional purposes such as marketing communications, where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time.

6Data Sharing & Disclosure

6.1 phhoy does not sell, trade, or rent your Personal Data to third parties. Data is shared only in the limited circumstances described in this Section.

6.2 Game Providers

Licensed game providers — including Evolution, JILI, Pragmatic Play, PG Soft, and FC Games — receive limited Player data necessary to deliver their games (e.g., session tokens). These providers are contractually prohibited from using phhoy Player data for any purpose other than game delivery. All providers are bound by equivalent data protection standards.

6.3 Payment Processors

To process deposits and withdrawals, phhoy shares necessary transaction data with Philippine payment processors including GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), GrabPay, BPI, BDO, Metrobank, and InstaPay partner banks. Data shared is limited to what is required to complete the specific transaction.

6.4 Regulatory Authorities

phhoy may disclose Personal Data to Philippine regulatory or law enforcement authorities — including PAGCOR and the Anti-Money Laundering Council (AMLC) — where required by law or in response to lawful information requests.

6.5 Professional Advisors

phhoy may share Personal Data with legal counsel, auditors, and compliance consultants under strict confidentiality obligations where necessary for legitimate business operations.

6.6 Business Transfers

In the event of a merger, acquisition, or sale of phhoy's business, Personal Data held by phhoy may be transferred to the successor entity, subject to the same data protection standards described in this Policy. Players will be notified of any such transfer via their registered contact details.

7KYC & Identity Document Data

7.1 KYC identity documents — including photographs of government-issued IDs and selfie verification images — are treated as Sensitive Personal Information under the DPA and are subject to heightened protection standards at phhoy.

7.2 KYC documents are stored in a dedicated secure document repository, encrypted with AES-256 at rest. Access to this repository is strictly limited to authorized compliance personnel and is logged for audit purposes.

7.3 KYC documents are used exclusively for the purposes of: (a) verifying the identity and age of the account holder; (b) complying with AML and regulatory obligations; and (c) fraud prevention and account security investigations.

7.4 KYC documents are not shared with game providers, marketing partners, or any third party other than those described in Section 6.4 (regulatory authorities) where legally required.

7.5 Retention of KYC documents is governed by Section 9 of this Policy. After the applicable retention period, KYC documents are permanently and securely deleted from phhoy's systems.

8Cookies & Tracking Technologies

8.1 phhoy uses cookies and similar tracking technologies on the phhoy platform. Cookies are small text files stored on your device that help phhoy provide a functional, secure, and personalized experience.

8.2 Types of Cookies Used by phhoy

• Essential Cookies: Required for core platform functionality, including session authentication, security tokens, and navigation. These cannot be disabled without disrupting platform access.
• Functional Cookies: Remember your preferences such as language settings, responsible gaming limit configurations, and recently played games. These improve your experience but are not strictly essential.
• Analytics Cookies: Used in aggregated, anonymized form to understand how Players use the platform — which game categories are most visited, where navigation issues occur, and how platform performance can be improved. phhoy uses self-hosted analytics and does not share raw analytics data with third parties.

8.3 Cookies phhoy Does NOT Use

phhoy does not use cross-site advertising cookies, behavioral retargeting pixels, or social media tracking technologies that monitor your activity on websites other than phhoy.cam.

8.4 Managing Cookies

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent login and game access. Disabling analytics cookies has no effect on your gameplay experience. Most modern browsers — Chrome on Android, Safari on iOS — provide straightforward cookie management in their Settings menu.

9Data Retention

9.1 phhoy retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law.

9.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures. Anonymized, aggregated data from which individual Players cannot be identified may be retained indefinitely for statistical and platform improvement purposes.

10Data Security

10.1 phhoy implements technical, organizational, and administrative safeguards appropriate to the sensitivity of the Personal Data processed. Key security measures include:

• Encryption in transit: All data exchanged between your device and phhoy's servers is encrypted using TLS 1.3, the current industry standard. The padlock icon in your browser confirms an active TLS connection.
• Encryption at rest: All stored Personal Data, including KYC documents and financial records, is encrypted using AES-256.
• Access controls: Access to Personal Data systems is restricted to authorized personnel on a need-to-know basis, enforced through role-based access control and multi-factor authentication.
• Intrusion detection: phhoy's infrastructure is monitored 24/7 for unauthorized access attempts, anomalous activity, and potential security incidents.
• Security audits: phhoy conducts periodic security assessments and vulnerability testing to identify and remediate potential weaknesses in its data protection infrastructure.
• Employee training: All phhoy staff with access to Personal Data undergo data privacy training aligned with DPA requirements.

10.2 Data Breach Notification. In the event of a personal data breach that is likely to result in harm to Data Subjects, phhoy will notify affected Players and the National Privacy Commission in accordance with the timelines prescribed by the DPA and NPC Circular No. 16-03.

10.3 While phhoy takes reasonable measures to protect your data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the security of your phhoy account credentials and for reporting any suspected unauthorized access to [email protected] immediately.

11Your Rights as a Data Subject

11.1 Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your Personal Data held by phhoy:

• Right to be Informed: The right to know what Personal Data phhoy holds about you, how it is collected, and how it is used — as described in this Policy.
• Right to Access: The right to obtain a copy of your Personal Data held by phhoy, subject to identity verification and reasonable administrative timeframes.
• Right to Correction: The right to request correction of inaccurate or incomplete Personal Data in your phhoy account.
• Right to Erasure or Blocking: The right to request deletion or blocking of Personal Data that is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Object: The right to object to processing of your Personal Data for purposes other than those strictly required for contract performance or legal compliance, including marketing.
• Right to Data Portability: The right to receive a copy of your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Damages: The right to be indemnified for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained Personal Data held by phhoy.
• Right to Complain: The right to file a complaint with the National Privacy Commission (NPC) if you believe phhoy has violated your data privacy rights.

11.2 To exercise any of these rights, submit a written request to phhoy's Data Protection Officer at [email protected] with the subject line "Data Privacy Request." phhoy will respond within fifteen (15) business days. Identity verification will be required before processing sensitive requests.

12Marketing Communications

12.1 phhoy sends marketing communications — including emails about new games, promotions, bonus offers, and platform updates — only to Players who have explicitly opted in to receive such communications.

12.2 You may opt in to marketing communications during registration or at any time via Account Settings. Opting in is not a condition of account registration or platform access.

12.3 You may withdraw your marketing consent and unsubscribe from all marketing communications at any time by: (a) updating your preferences in Account Settings; or (b) clicking the "Unsubscribe" link included in every marketing email from phhoy; or (c) contacting phhoy support at [email protected].

12.4 Withdrawal of marketing consent does not affect your ability to access and use the phhoy platform, and does not constitute account closure.

12.5 Transactional communications — including deposit confirmations, withdrawal notifications, account security alerts, and responsible gaming notifications — are not marketing communications and will be sent regardless of marketing consent status, as they are necessary for account management.

13Children & Minors

13.1 phhoy's platform is strictly for individuals aged 21 years and above. phhoy does not knowingly collect Personal Data from persons under 21 years of age.

13.2 If phhoy becomes aware that Personal Data has been collected from a person under 21 years of age, the account will be immediately suspended, all Personal Data associated with the minor will be deleted, and any deposited funds will be returned to the source payment method after completing required verification.

13.3 If you are a parent or guardian and believe that a person under 21 in your household has created a phhoy account using false information, please contact phhoy support immediately at [email protected].

14Cross-Border Data Transfers

14.1 Some of phhoy's service providers — including certain licensed game providers — are headquartered or operate servers outside the Republic of the Philippines. Where Personal Data is transferred outside the Philippines, phhoy ensures that such transfers are protected by adequate contractual safeguards, including data processing agreements that require equivalent standards of protection to those required under Philippine law.

14.2 phhoy will not transfer Personal Data to jurisdictions that do not provide adequate data protection standards without first implementing appropriate contractual protections and, where required, obtaining your consent.

14.3 All financial transaction data relating to Philippine payment methods (GCash, Maya, BPI, BDO, Metrobank, InstaPay) is processed within Philippine jurisdiction by the respective Philippine-registered payment providers.

15Updates to This Privacy Policy

15.1 phhoy reserves the right to update or amend this Privacy Policy from time to time to reflect changes in data processing practices, legal requirements, or platform functionality.

15.2 Material changes to this Policy will be communicated to Players via registered email address and/or a prominent notice on the phhoy platform at least seven (7) days before taking effect, where practicable.

15.3 The effective date displayed at the top of this page indicates the date of the most recent revision. The current version of this Policy is always accessible at phhoy.cam/privacy-policy. Continued use of the phhoy platform following the effective date of any amendment constitutes acceptance of the revised Policy.

15.4 If you do not accept any amended Privacy Policy, you must discontinue use of the phhoy platform and may request account closure by contacting [email protected].

16Contact & Data Protection Officer

16.1 phhoy has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the Philippine Data Privacy Act. For any data privacy related inquiries, requests, or complaints, contact the phhoy DPO using the details below:

• Email: [email protected] (Subject line: "Data Privacy Request")
• Live Chat: Available on phhoy.cam, 8 AM to 12 MN Manila Standard Time daily
• Response Time: Within fifteen (15) business days for formal data subject rights requests

16.2 phhoy will verify your identity before processing any request to access, correct, or delete your Personal Data, to ensure the security of your information.

16.3 If you are unsatisfied with phhoy's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.