phmanila Privacy Policy

This Privacy Policy ("Policy") describes how phmanila ("we," "us," "our") collects, uses, stores, shares, and protects the personal data of individuals ("you," "Player") who access or use the phmanila online gaming platform at phmanila.net (the "Platform").

By registering an account or using any service on the phmanila Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform.

This Policy applies to all personal data collected through phmanila's website, mobile-optimized browser interface, customer support channels, and any other point of contact between you and phmanila. It should be read alongside our Terms & Conditions and Responsible Gaming Policy.

phmanila acts as the Data Controller in respect of personal data collected through the Platform, as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations issued by the National Privacy Commission ("NPC").

As Data Controller, phmanila is responsible for determining the purposes and means of processing your personal data. phmanila has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with this Policy and applicable data protection law. Data-related inquiries, access requests, and complaints may be directed to our DPO through our customer support channel. Contact: [email protected] (plain text — not a clickable link).

phmanila collects personal data that falls into the following categories:

phmanila does not intentionally collect sensitive personal information as defined under the DPA (such as health data, political opinions, or religious beliefs) except where required by law, such as information relating to problem gambling reported through responsible gaming channels, which is treated with the highest confidentiality.

phmanila collects personal data through the following means:

• Direct submission: Data you provide during account registration, identity verification, payment processing, and customer support interactions.
• Automated collection: Technical data collected automatically when you visit the Platform, including IP address, device identifiers, browser metadata, and session activity logs.
• Payment processors: Transaction confirmation data received from payment providers such as GCash, Maya, and Philippine bank systems when you make deposits or withdrawals.
• Identity verification services: Confirmation of identity document validity from authorized verification service providers used for KYC compliance.
• Cookies and similar technologies: Session management data and optional analytics data collected through cookies placed on your device. See Section 7 for details.

phmanila does not purchase personal data from data brokers or third-party list providers. All personal data we hold is collected directly from you or from service providers acting on our behalf in connection with your phmanila account.

phmanila processes your personal data for the following purposes, each supported by a lawful basis under the Data Privacy Act of 2012:

phmanila will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your separate, explicit consent or establishing an alternative lawful basis under the DPA.

phmanila does not sell, rent, or trade your personal data to any third party. Your data may be shared only in the following limited circumstances:

• Payment processors: GCash, Maya, GrabPay, and partnered banks (BPI, BDO, Metrobank) receive only the data necessary to process your transactions. These providers are bound by their own data protection obligations and applicable Philippine financial regulations.
• Identity verification providers: Third-party KYC service providers receive identity document data solely to verify account holder identity. These providers operate under strict confidentiality and data processing agreements.
• Game providers: Certified game studios (including Pragmatic Play, PG Soft, Jili, and others) may receive your account session identifier and bet data to deliver game content and manage jackpot pools. Providers do not receive your identity or contact data beyond session tokens.
• Regulatory authorities: phmanila may disclose personal data to Philippine regulatory authorities, law enforcement agencies, or courts where required by law, pursuant to a valid legal process, or to prevent fraud or money laundering.
• Professional advisors: Legal, accounting, and auditing firms engaged by phmanila may access personal data to the minimum extent required to provide their professional services, under strict confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or sale of phmanila's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection standards. Affected players will be notified in advance.

All third-party processors who handle phmanila player data are required to enter into data processing agreements that impose data protection obligations equivalent to those under the Philippine Data Privacy Act.

phmanila uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files stored on your device when you visit phmanila.net. The following types of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session management cookies that keep you logged in during a gaming session, security tokens, and load balancing cookies. These cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences — such as your chosen game category, language preference, and responsible gaming settings — to personalize your experience on return visits.
• Analytics cookies: Collect anonymized data about how players navigate the Platform (pages visited, time on page, error rates) to help phmanila identify and fix usability issues. This data is aggregated and cannot be used to identify individual players.
• Security cookies: Help detect and prevent fraudulent login attempts, unusual account activity, and CSRF attacks. These are required for platform integrity.

phmanila does not use advertising or cross-site tracking cookies. You may configure cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent normal Platform operation. phmanila does not respond to "Do Not Track" browser signals because the Platform's analytics do not engage in the cross-site tracking that DNT signals are designed to address.

phmanila retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Active account data: Retained for the duration of your phmanila account and for five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with the Anti-Money Laundering Act (AMLA) and BSP regulations applicable to electronic money transaction records.
• Identity verification documents: Retained for five (5) years after account closure or the termination of the business relationship, whichever is later.
• Customer support records: Retained for three (3) years from the date of the interaction, unless the record is required in connection with an ongoing dispute or regulatory inquiry.
• Gaming activity logs: Retained for five (5) years for compliance and audit purposes. Anonymized aggregate analytics data may be retained indefinitely.
• Marketing communication preferences: Retained until you withdraw consent or close your account.

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymized in accordance with phmanila's data deletion procedures.

phmanila implements technical and organizational security measures appropriate to the risks associated with processing personal data on an online gaming platform. Key measures include:

• Encryption in transit: All data transmitted between your device and phmanila's servers is encrypted using 256-bit SSL/TLS — the same standard used by Philippine banks.
• Encryption at rest: Personal data stored in phmanila's databases is encrypted at rest using industry-standard encryption protocols.
• Password security: Account passwords are processed using one-way cryptographic hashing (bcrypt). phmanila never stores or has access to plaintext passwords.
• Access controls: Access to personal data within phmanila's systems is restricted on a need-to-know basis, with role-based access controls and comprehensive audit logging of data access events.
• Two-factor authentication: SMS-based 2FA is triggered automatically for logins from new devices or unusual locations, providing an additional security layer for your account.
• Vulnerability management: phmanila conducts regular security assessments and penetration tests. Identified vulnerabilities are remediated under a defined severity-based response timeline.
• Incident response: phmanila maintains a documented data breach response procedure. In the event of a breach affecting your personal data, phmanila will notify the National Privacy Commission and affected players within the timeframes required under the DPA.

While phmanila takes all reasonable precautions to protect personal data, no data transmission over the internet or electronic storage system is 100% secure. If you have reason to believe your phmanila account has been compromised, contact our support team immediately via live chat.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmanila:

• Right to be informed: You have the right to be informed about how phmanila collects, uses, and processes your personal data — which is the purpose of this Policy.
• Right of access: You may request a copy of the personal data phmanila holds about you, along with information about how that data is being used.
• Right to rectification: You may request correction of any inaccurate, incomplete, or outdated personal data in your phmanila account.
• Right to erasure: You may request deletion of your personal data where processing is no longer necessary for the purpose for which it was collected, subject to phmanila's legal retention obligations under AMLA and other applicable regulations.
• Right to object: You may object to the processing of your personal data for purposes based on legitimate interests, including direct marketing. Objections to marketing can be processed immediately through your account communication settings.
• Right to data portability: You may request that phmanila provide your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phmanila has processed your personal data in violation of the DPA.

The phmanila Platform is strictly intended for individuals aged twenty-one (21) years and above. phmanila does not knowingly collect personal data from individuals under 21 years of age. All account registrations require confirmation of age eligibility, and phmanila performs identity verification that includes date of birth confirmation prior to processing withdrawals.

If phmanila becomes aware that personal data has been collected from an individual under the age of 21, the account will be immediately closed, all funds will be returned to the payment source after deducting any bonus amounts received, and all associated personal data will be securely deleted. If you believe phmanila may have inadvertently collected data from an underage individual, please contact our support team immediately.

phmanila's primary data infrastructure is located within or managed in the context of the Philippine market. In connection with the delivery of certain services — particularly game content delivered by international studio partners and certain technical infrastructure services — personal data may be processed by systems located outside the Philippines.

Where personal data is transferred internationally, phmanila ensures that such transfers are conducted in compliance with the requirements of the Philippine Data Privacy Act, including the requirement that the receiving jurisdiction or organization provides an adequate level of protection for personal data. phmanila uses contractual safeguards — specifically data processing agreements incorporating data protection clauses — when transferring personal data to overseas processors.

Data shared with game providers outside the Philippines is limited to session tokens and anonymized gaming identifiers — not your name, contact details, or financial information.

phmanila may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. Material changes to this Policy will be communicated to registered players via account notification or SMS to the registered Philippine mobile number no less than seven (7) calendar days before the changes take effect.

The current version of this Policy is always available at phmanila.net/privacy-policy, with the effective date clearly stated. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy. If you do not accept a revised Policy, you should close your account in accordance with the account closure procedure in our Terms & Conditions.

For all data privacy queries, access requests, rectification requests, complaints, or other data rights matters, contact phmanila's Data Protection Officer through any of the following channels:

• Live Chat: Available 24/7 through the phmanila Platform — ask to be connected to the DPO team for data privacy matters.
• Email (plain text): [email protected] — use subject line "DATA PRIVACY REQUEST" to ensure prompt routing to the DPO team.

phmanila will acknowledge all data privacy requests within three (3) business days and provide a substantive response within fifteen (15) business days. Where a request requires additional time due to complexity, phmanila will notify you within the initial fifteen-day period and provide an updated timeline.

If you are not satisfied with phmanila's response to a data privacy request, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.