phtsya Privacy Policy

1 Who We Are

phtsya ("phtsya," "we," "us," or "our") is an online gaming and sports betting platform operating in the Republic of the Philippines under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR). This Privacy Policy applies to all personal data collected and processed by phtsya through the phtsya website at phtsya.net, its mobile interface, and all associated services (collectively, the "Platform").

phtsya acts as the Personal Information Controller (PIC) in respect of the personal data you provide when registering and using the Platform, as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations.

Our designated Data Protection Officer (DPO) can be reached at the contact details provided in Section 14 of this Policy. The DPO is responsible for overseeing phtsya's data protection practices and ensuring compliance with the DPA and the regulations of the National Privacy Commission (NPC).

2 Personal Data We Collect

phtsya collects the following categories of personal data from users of the Platform:

2.1 Registration and Identity Data

• Full legal name as it appears on a government-issued ID
• Date of birth (used to verify the 21+ age requirement)
• Residential address, including barangay, city or municipality, province, and postal code
• Email address and mobile number
• Username and encrypted password
• Nationality and country of residence

2.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., Philippine passport, SSS ID, PhilHealth ID, UMID, driver's license, or Postal ID)
• Proof of address documents (e.g., utility bills, bank statements)
• Selfie or facial image submitted for liveness verification, where required
• Source of funds documentation, where required under AML regulations

2.3 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, and payment method references
• GCash or Maya account reference numbers (partial, for transaction matching)
• Bank account details (bank name, account name, and partial account number) for withdrawal processing
• Debit card details (card type and last four digits only; full card numbers are never stored by phtsya)

2.4 Gaming Activity Data

• Game session records, including games played, wager amounts, outcomes, and session duration
• Bonus and promotion usage history
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status)

2.5 Technical and Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Unique device identifiers
• Log data including access times, pages visited, and error logs

2.6 Communications Data

• Records of your communications with phtsya customer support, including live chat transcripts and email correspondence
• Survey responses and feedback submitted through the Platform

3 How We Collect Your Data

phtsya collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, participate in promotions, or update your account settings.
• Automatically through the Platform: When you access and use the phtsya website or mobile interface, we automatically collect technical and device data through cookies, web beacons, and server logs. See Section 7 for more information on cookies.
• From third-party verification providers: phtsya works with accredited identity verification and KYC service providers to verify the authenticity of documents and confirm your identity. These providers may supply us with verification results and risk scores.
• From payment processors: When you make a deposit or withdrawal, our payment processing partners (such as GCash, Maya, and partner banks) provide transaction confirmation data to phtsya.
• From regulatory and law enforcement authorities: phtsya may receive data from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine government agencies in connection with regulatory compliance obligations.

4 How We Use Your Personal Data

phtsya uses your personal data for the following purposes:

• Account creation and management: To register your account, verify your identity, and manage your ongoing relationship with phtsya.
• Age and eligibility verification: To confirm that you meet the 21+ age requirement and other eligibility criteria under Philippine law and PAGCOR regulations.
• KYC and AML compliance: To fulfill our obligations under the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended) and PAGCOR's KYC requirements, including verifying the source of funds and monitoring for suspicious transactions.
• Processing deposits and withdrawals: To facilitate financial transactions on your account using your chosen payment method.
• Delivering gaming services: To provide access to games, process wagers, calculate and credit winnings, and administer bonuses and promotions.
• Responsible gaming: To implement and monitor responsible gaming tools such as deposit limits, session limits, and self-exclusion, and to identify players who may be at risk of problem gambling.
• Customer support: To respond to your inquiries, resolve disputes, and provide technical assistance.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the Platform.
• Platform improvement: To analyze usage patterns, conduct research, and improve the features, performance, and user experience of the phtsya Platform.
• Marketing communications: To send you promotional offers, bonus notifications, and news about phtsya, where you have consented to receive such communications. You may opt out at any time.
• Legal and regulatory compliance: To comply with applicable Philippine laws, PAGCOR regulations, court orders, and requests from competent government authorities.

5 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phtsya processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary for the performance of the contract between you and phtsya — specifically, to provide you with access to the Platform and gaming services as described in our Terms and Conditions.
• Legal obligation: Processing is required to comply with phtsya's legal obligations under Philippine law, including the DPA, the Anti-Money Laundering Act, PAGCOR regulations, and applicable tax laws.
• Legitimate interests: Processing is necessary for phtsya's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and business analytics, provided these interests are not overridden by your rights and freedoms.
• Consent: For certain processing activities, such as sending marketing communications and the use of non-essential cookies, phtsya relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6 Data Sharing and Disclosure

phtsya does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Identity verification and KYC providers: Accredited third-party providers that assist phtsya in verifying your identity and documents as required by PAGCOR and AML regulations.
• Payment processors: GCash, Maya, partner banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank), and debit card processors, for the purpose of processing your deposits and withdrawals.
• Game software providers: Third-party game developers and platform providers whose games are offered on phtsya. These providers may receive limited gaming activity data necessary to operate their games.
• IT and cloud service providers: Providers of hosting, data storage, cybersecurity, and technical infrastructure services that support the operation of the phtsya Platform.
• Customer support platforms: Third-party providers of live chat and customer relationship management (CRM) software used to manage player support interactions.
• Regulatory and government authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other Philippine government agencies, where disclosure is required by law, regulation, or court order.
• Professional advisers: Lawyers, auditors, and other professional advisers engaged by phtsya, subject to professional confidentiality obligations.

All third-party service providers engaged by phtsya are required to process personal data only in accordance with phtsya's instructions and to implement appropriate technical and organizational security measures. phtsya enters into data processing agreements with all relevant third-party processors as required by the DPA.

7 Cookies and Tracking Technologies

phtsya uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit a website. phtsya uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the Platform to function correctly. They enable core features such as account login, session management, and security. These cookies cannot be disabled.
• Performance and analytics cookies: These cookies collect information about how you use the Platform, such as which pages you visit most often and whether you encounter any errors. This data is used in aggregate form to improve the Platform's performance and user experience.
• Functional cookies: These cookies allow the Platform to remember your preferences, such as your language settings and responsible gaming tool configurations, to provide a more personalized experience.
• Marketing cookies: These cookies track your browsing activity to help phtsya deliver relevant promotional content. They are only placed with your consent.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the phtsya Platform. For more information on managing cookies, refer to your browser's help documentation.

8 Data Retention

phtsya retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• KYC and verification documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable AML regulations or ongoing investigations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with BIR and AMLC requirements.
• Gaming activity logs: Retained for a minimum of three (3) years from the date of each gaming session.
• Customer support records: Retained for three (3) years from the date of the last interaction, or longer if the records are relevant to an ongoing dispute or legal proceeding.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent, as evidence of the consent given.

Upon expiry of the applicable retention period, phtsya will securely delete or anonymize your personal data in accordance with its data disposal procedures.

9 Data Security

phtsya implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the phtsya Platform is encrypted using Transport Layer Security (TLS 1.2 or higher).
• Encryption at rest: Sensitive personal data stored in phtsya's systems is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to phtsya personnel and authorized third-party processors who require it to perform their duties. Role-based access controls and the principle of least privilege are applied.
• Two-factor authentication: phtsya supports and encourages the use of two-factor authentication (2FA) for player accounts to reduce the risk of unauthorized access.
• Regular security assessments: phtsya conducts regular vulnerability assessments and penetration testing of its systems and infrastructure.
• Incident response: phtsya maintains a data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, phtsya will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected individuals as required by the DPA.

While phtsya takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are also responsible for maintaining the security of your account credentials. See Section 4 of our Terms and Conditions for your account security obligations.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phtsya:

• Right to be informed: You have the right to be informed about how phtsya collects and processes your personal data. This Privacy Policy fulfills that obligation.
• Right of access: You have the right to request a copy of the personal data phtsya holds about you, along with information about how it is being processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data phtsya holds about you. You may update certain account details directly through your account settings.
• Right to erasure or blocking: You have the right to request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful. This right is subject to phtsya's legal retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, subject to phtsya's overriding legitimate grounds.
• Right to data portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another personal information controller where technically feasible.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe phtsya has violated your data privacy rights. The NPC can be reached at privacy.gov.ph.

To exercise any of the above rights, please contact phtsya's Data Protection Officer using the contact details in Section 14. phtsya will respond to all verified data subject requests within thirty (30) days of receipt, in accordance with the DPA and NPC regulations.

11 Children's Privacy

The phtsya Platform is strictly intended for adults aged 21 years and above. phtsya does not knowingly collect personal data from individuals under the age of 21. The 21+ age requirement is a strict legal requirement under Philippine law and PAGCOR regulations governing casino-style online gaming.

phtsya employs age verification procedures during the registration process to prevent underage individuals from creating accounts. If phtsya becomes aware that personal data has been collected from a person under 21 years of age, the account will be immediately suspended, all associated data will be reviewed, and the account will be closed in accordance with our Terms and Conditions.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gaming platforms. If you believe a minor has registered on the phtsya Platform, please contact us immediately using the details in Section 14.

12 Cross-Border Data Transfers

phtsya primarily processes and stores personal data within the Republic of the Philippines. However, some of phtsya's third-party service providers — including cloud infrastructure providers, game software developers, and KYC verification platforms — may be located outside the Philippines and may process personal data in other jurisdictions.

Where personal data is transferred outside the Philippines, phtsya ensures that appropriate safeguards are in place to protect your data in accordance with the DPA and NPC regulations. These safeguards may include:

• Data processing agreements incorporating standard contractual clauses approved by the NPC or equivalent data protection authorities.
• Transfers to countries or organizations that have been assessed as providing an adequate level of data protection.
• Binding corporate rules where applicable within corporate group structures.

By using the phtsya Platform, you acknowledge that your personal data may be transferred to and processed in countries outside the Philippines, subject to the safeguards described above.

13 Updates to This Privacy Policy

phtsya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulations, or NPC guidance. When material changes are made, phtsya will notify registered players via email or a prominent notice on the Platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised. The current version of this Privacy Policy is always available on the phtsya Platform at phtsya.net/privacy-policy.

Your continued use of the phtsya Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Privacy Policy, you must cease using the Platform and may request account closure by contacting our support team.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or phtsya's data processing practices, please contact our Data Protection Officer through the following channels:

• Email (DPO): privacy at phtsya.net
• General Support Email: support at phtsya.net
• Live Chat: Available 24/7 through the phtsya Platform

phtsya aims to respond to all privacy-related inquiries within 15 business days. For formal data subject requests, a response will be provided within 30 days as required by the DPA.

If you are not satisfied with phtsya's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

• National Privacy Commission (NPC): privacy.gov.ph
• NPC Complaints: complaints at privacy.gov.ph