phtya Privacy Policy

1 Who We Are — The Data Controller

For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and its implementing rules and regulations, phtya is the personal information controller responsible for the personal data of Players registered on the phtya platform. phtya operates under PAGCOR regulatory oversight and is accountable for the lawful, fair, and transparent processing of all personal data collected through phtya.club.

phtya has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173. Contact details for the phtya DPO are provided in Section 14 of this Policy. Players with questions or concerns about their personal data are encouraged to contact the DPO directly in the first instance.

2 Personal Data We Collect

2.1 Registration and Account Data

When you create a phtya account, we collect the following personal information:

• Full legal name as it appears on your Philippine government-issued identification;
• Date of birth (to verify compliance with the 21+ age requirement under PAGCOR regulations);
• Registered Philippine mobile number (used as primary account identifier and for OTP authentication);
• Email address;
• Residential address in the Philippines;
• Account username and encrypted password credentials.

2.2 Identity Verification (KYC) Data

As required by PAGCOR regulatory obligations, phtya collects the following KYC documentation from all Players seeking to make real-money deposits or withdrawals:

• Copies of valid Philippine government-issued photo identification (PhilSys National ID, UMID, Driver's License, Passport, or other PAGCOR-accepted documents);
• Facial biometric data captured during liveness verification procedures where applicable;
• Proof of Philippine residential address (utility bill, bank statement, or other accepted documentation) for enhanced due diligence where required.

2.3 Financial Transaction Data

phtya collects and retains records of all financial transactions conducted through a Player's account wallet, including:

• Deposit amounts, methods (GCash, PayMaya, BDO, BPI, Metrobank), and timestamps;
• Withdrawal amounts, methods, and processing records;
• Wagering history, game outcomes, and bonus transaction records;
• Payment account identifiers (e.g., GCash mobile number, bank account last four digits) where necessary for transaction processing and fraud prevention.

2.4 Technical and Usage Data

phtya automatically collects certain technical data when you access the platform, including:

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session timestamps, page navigation data, and in-platform behavioural patterns;
• Cookie identifiers and similar tracking technology data as detailed in Section 10.

2.5 Customer Support Communications

When you contact phtya's customer support team through any channel, phtya retains records of those communications — including chat transcripts, email correspondence, and call recordings where applicable — for quality assurance, training, compliance, and dispute resolution purposes.

3 How We Collect Your Personal Data

phtya collects personal data through the following means:

• Directly from you — through the phtya account registration form, KYC document upload process, deposit and withdrawal requests, customer support interactions, and promotional participation forms;
• Automatically through platform usage — via server logs, cookies, and tracking technologies as you navigate and interact with phtya.club and its associated mobile interfaces;
• From third-party service providers — including identity verification providers, payment processors (GCash, PayMaya, BDO, BPI, Metrobank), fraud detection services, and PAGCOR regulatory reporting systems, where such third parties are required to share data with phtya to fulfil their contractual or regulatory obligations to us.

4 Purposes for Which We Process Your Personal Data

phtya processes your personal data for the following clearly defined, legitimate purposes:

• Creating, managing, and maintaining your phtya account;
• Verifying your identity and age in compliance with PAGCOR KYC requirements;
• Processing deposits, withdrawals, and in-platform financial transactions;
• Operating, personalising, and improving the phtya platform and game lobby;
• Detecting, preventing, and investigating fraud, money laundering, and other prohibited conduct in compliance with the Anti-Money Laundering Act (AMLA) and applicable PAGCOR regulations;
• Complying with mandatory regulatory reporting obligations to PAGCOR and other competent Philippine authorities;
• Providing customer support and resolving player disputes;
• Sending transactional communications (account notifications, deposit confirmations, withdrawal updates, OTP messages);
• Sending promotional communications about phtya offers where you have consented to receive such communications or where permitted under applicable law;
• Administering responsible gaming tools, including deposit limit enforcement and self-exclusion programs;
• Analysing platform usage patterns to improve security, performance, and player experience.

5 Legal Basis for Processing

phtya processes your personal data on the following legal bases under Republic Act No. 10173:

• Contractual necessity — processing that is necessary to fulfil phtya's contractual obligations to you as a registered Player, including account management, transaction processing, and customer support;
• Legal obligation — processing required by applicable Philippine law and PAGCOR regulations, including KYC verification, AML transaction monitoring, and mandatory regulatory reporting;
• Legitimate interests — processing necessary for phtya's legitimate interests in operating a secure, fair, and commercially viable online gaming platform, including fraud prevention, security monitoring, and platform analytics, where those interests are not overridden by your rights and interests;
• Consent — where phtya relies on your consent as the lawful basis for processing (e.g., marketing communications), you may withdraw that consent at any time by contacting phtya support or updating your account communication preferences, without prejudice to the lawfulness of processing carried out prior to withdrawal.

6 Sharing Your Personal Data

6.1 Service Providers

phtya shares personal data with carefully selected third-party service providers who assist in operating the phtya platform. These providers are contractually bound to process personal data only in accordance with phtya's instructions and this Privacy Policy, and are prohibited from using that data for their own purposes. Categories of service providers include: identity verification and KYC platforms; payment processors (GCash, PayMaya, BDO, BPI, Metrobank); cloud hosting and data storage providers; fraud detection and anti-money laundering analytics services; customer support software providers; and game content providers (game engine data relevant to RNG audits only).

6.2 Regulatory and Law Enforcement Authorities

phtya is required by Philippine law and PAGCOR regulations to disclose personal data to regulatory and law enforcement authorities in specified circumstances, including: compliance with PAGCOR licensing conditions and audits; mandatory reporting of suspicious transactions under the AMLA; responses to lawful court orders or judicial process; and cooperation with PAGCOR investigation procedures. phtya will notify affected Players of such disclosures where legally permissible to do so.

6.3 Business Transfers

In the event that phtya undergoes a business restructuring, merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity as part of that transaction. phtya will provide notice of such a transfer and ensure that the successor entity assumes obligations equivalent to those set out in this Privacy Policy.

7 International Data Transfers

Some of phtya's third-party service providers may process personal data outside the Republic of the Philippines. Where personal data is transferred internationally, phtya ensures that appropriate safeguards are in place to protect that data to a standard equivalent to the protections afforded under RA 10173 — including contractual data protection clauses with overseas processors and confirmation that recipient countries have adequate data protection laws recognised by the National Privacy Commission. Players may request information about specific international transfers by contacting the phtya DPO.

8 Data Retention

phtya retains personal data for no longer than is necessary for the purposes for which it was collected, subject to mandatory retention requirements imposed by Philippine law and PAGCOR regulations. The following indicative retention periods apply:

• Account and KYC data: Retained for the duration of your active phtya account and for a minimum of five (5) years following account closure, in compliance with AMLA and PAGCOR record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years following the transaction date in compliance with AMLA;
• Customer support communications: Retained for three (3) years from the date of the communication for quality assurance and dispute resolution purposes;
• Technical and usage data: Retained for up to twelve (12) months from collection for security and analytics purposes;
• Marketing consent records: Retained until consent is withdrawn and for a further period of three (3) years to evidence compliance with consent requirements.

9 Your Data Subject Rights

As a data subject under Republic Act No. 10173, you have the following rights in relation to your personal data held by phtya:

To exercise any of the above rights, contact the phtya Data Protection Officer at the details provided in Section 14. phtya may require verification of your identity before processing a data rights request.

10 Cookies and Tracking Technologies

phtya uses cookies and similar tracking technologies on the phtya.club platform for the following purposes:

• Strictly necessary cookies: Required for the platform to function, including session authentication, security tokens, and platform state management. These cookies cannot be disabled without affecting core platform functionality.
• Performance and analytics cookies: Used to measure platform performance, identify technical issues, and analyse player navigation patterns to improve the phtya user experience. Data collected is aggregated and anonymised where possible.
• Functional cookies: Enable personalisation features such as remembering your preferred language settings, game lobby filters, and responsible gaming tool configurations.
• Marketing cookies: Used with your consent to deliver relevant phtya promotional content based on your platform activity. You may withdraw consent for marketing cookies at any time through your browser settings.

Most web browsers allow you to control cookie settings through the browser's settings menu. Disabling strictly necessary cookies may impair your ability to log in to phtya and use core platform features.

11 Security Measures

phtya implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between player devices and phtya infrastructure;
• Encryption of sensitive data at rest, including KYC documents and financial transaction records;
• Role-based access controls limiting personal data access to authorised phtya personnel with a legitimate operational need;
• Multi-factor authentication requirements for all internal access to systems holding personal data;
• Regular third-party security penetration testing and vulnerability assessments;
• Documented incident response procedures for personal data breaches, including notification to the National Privacy Commission and affected Players within the timeframes required by RA 10173.

12 Children's Privacy and Age Restriction

The phtya platform is strictly restricted to individuals aged twenty-one (21) years and older as required by PAGCOR regulations. phtya does not knowingly collect personal data from individuals under the age of 21. All registration requests are subject to mandatory KYC age verification. If phtya becomes aware that personal data has been collected from a person under the age of 21, that account will be immediately closed, all associated data will be securely deleted to the extent permitted by law, and the matter will be reported to PAGCOR where required by applicable regulations.

13 Amendments to This Privacy Policy

phtya reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, or phtya's data processing practices. Material changes to this Policy will be communicated to registered Players via their registered email address or via a prominent on-platform notice at least seven (7) days before the revised Policy takes effect. The date of the most recent revision is indicated at the top of this document. Continued use of the phtya platform following notification of a revised Privacy Policy constitutes acceptance of the revised terms.

14 Contact and Data Protection Officer

For all personal data enquiries, data rights requests, or privacy-related complaints, please contact the phtya Data Protection Officer: