phophen Privacy Policy

This Privacy Policy ("Policy") describes how phophen ("phophen," "we," "us," or "our") collects, uses, stores, shares, and protects the personal information of users ("Player," "User," or "you") who access and use the phophen online gaming platform available at https://phophen.org and all related services (collectively, the "Platform").

phophen is committed to protecting the privacy and personal data of all Filipino players who use our platform. This Policy has been prepared in accordance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission ("NPC") of the Philippines.

This Policy applies to personal data collected through the Platform, including via the phophen website, customer support channels, and any communications between you and phophen. It does not apply to third-party websites or services linked from the Platform, which are governed by their own privacy policies.

phophen acts as the data controller in respect of the personal information processed under this Policy. As data controller, phophen determines the purposes and means of processing your personal data. phophen operates under the oversight of PAGCOR (Philippine Amusement and Gaming Corporation) and complies with all applicable PAGCOR data handling requirements applicable to licensed online gaming operators.

phophen has appointed a Data Protection Officer ("DPO") who is responsible for ensuring compliance with the DPA and this Policy. You may contact phophen's DPO at the contact details set out in Section 13 of this Policy.

phophen collects personal data from you directly when you register an account, use the Platform, contact customer support, or participate in promotions. We also collect certain data automatically when you access the Platform. The categories of personal data phophen collects include:

Identity and Contact Data:

• Full legal name, date of birth, and gender as provided at registration.
• Philippine mobile number and email address.
• Government-issued identification documents submitted for KYC verification (e.g., Philippine passport, SSS ID, PhilSys ID, driver's licence, or equivalent).
• Residential address in the Philippines (e.g., in Metro Manila, Cebu, Davao, Quezon City, or other provinces).

Financial Data:

• GCash account number, PayMaya account details, BPI, BDO, or Metrobank account details used for deposits and withdrawals.
• Transaction history including deposit amounts, withdrawal requests, game wager records, and bonus redemption history, all denominated in Philippine Peso (PHP).

Technical and Usage Data:

• IP address, device type, operating system, browser type and version, and mobile network information.
• Login timestamps, session duration, pages visited, and game activity logs.
• Cookie identifiers and similar tracking technologies as described in Section 10.

Communications Data:

• Records of your communications with phophen's customer support team via live chat, email, or any other channel.
• Voluntary feedback, survey responses, and promotional participation records.

phophen processes your personal data for the following specific, legitimate purposes:

• Account Registration and Management: To verify your identity, create and manage your phophen account, and maintain accurate account records as required by PAGCOR regulations.
• Age Verification and KYC Compliance: To verify that you are 21 years of age or older and to comply with PAGCOR's Know Your Customer requirements and Philippine anti-money laundering laws (Republic Act No. 9160, as amended).
• Payment Processing: To process your deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods, and to maintain accurate transaction records.
• Game Provision and Platform Operation: To deliver the phophen gaming services, personalise your gaming experience, and ensure the integrity and fairness of all games.
• Promotions and Bonuses: To administer phophen bonus offers, loyalty programmes, and promotional campaigns for which you are eligible.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, underage gambling, and other prohibited conduct on the phophen Platform.
• Customer Support: To respond to your enquiries, resolve disputes, and provide after-sales support related to your phophen account.
• Legal and Regulatory Compliance: To comply with all applicable Philippine laws, PAGCOR directives, NPC issuances, and lawful orders from Philippine courts or government authorities.
• Responsible Gaming: To monitor gaming behaviour for indicators of problem gambling and to administer responsible gaming tools such as deposit limits, session limits, and self-exclusion requests.

phophen processes your personal data on the following legal bases under the Philippine Data Privacy Act:

• Consent: Where you have given phophen specific, informed, and freely given consent to process your personal data for a specific purpose, such as receiving promotional communications.
• Contractual Necessity: Processing necessary for the performance of our contract with you as a registered phophen player, including account management, game provision, and payment processing.
• Legal Obligation: Processing required to comply with applicable Philippine laws and PAGCOR regulatory requirements, including AML compliance and age verification obligations.
• Legitimate Interest: Processing for phophen's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.

phophen does not sell your personal data to third parties. We may share your personal data with third parties only in the following circumstances and only to the extent necessary:

• Payment Processors: GCash (G-Xchange, Inc.), PayMaya (PayMaya Philippines, Inc.), BPI, BDO, and Metrobank, for the purpose of processing deposits and withdrawals to and from your phophen account.
• KYC and Identity Verification Providers: Third-party identity verification service providers engaged by phophen to perform age verification and KYC checks in compliance with PAGCOR requirements.
• Game Software Providers: Licensed game providers whose software is integrated into the phophen Platform may receive pseudonymised player activity data necessary for game operation and RTP auditing.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government agencies, where disclosure is required by law, regulation, or lawful order.
• IT and Security Service Providers: Hosting, cloud infrastructure, and cybersecurity vendors engaged by phophen under contractual data processing agreements that require them to process data only on phophen's instructions and to maintain appropriate security measures.

phophen retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine laws and PAGCOR regulations. The following general retention periods apply:

• Account and KYC records: Retained for a minimum of five (5) years following account closure, as required by PAGCOR and AML regulations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AML reporting obligations.
• Customer support communications: Retained for two (2) years from the date of the last communication, or longer if the communication relates to an ongoing dispute or regulatory matter.
• Marketing consent records: Retained until you withdraw consent or for three (3) years from the date of last interaction, whichever is earlier.

Upon expiry of the applicable retention period, phophen will securely destroy or anonymise your personal data in accordance with its data disposal procedures.

phophen implements technical and organisational security measures appropriate to the nature of the personal data processed and the risks of unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phophen's servers.
• Encryption of stored sensitive personal data including passwords (hashed), financial account details, and identity document images.
• Access controls restricting phophen staff access to personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability scanning of the phophen Platform.
• Multi-factor authentication for phophen internal systems that process personal data.

In the event of a personal data breach that is likely to prejudice your privacy rights, phophen will notify the National Privacy Commission and affected players in accordance with its obligations under the DPA and NPC Circular No. 16-03.

Under the Philippine Data Privacy Act, you have the following rights in respect of your personal data held by phophen:

• Right to be Informed: The right to be notified about how phophen collects and processes your personal data, as described in this Policy.
• Right of Access: The right to request a copy of the personal data phophen holds about you and information about how it is being processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by phophen.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phophen's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data where processing is based on legitimate interest or for direct marketing purposes.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe phophen has violated your data privacy rights.

To exercise any of these rights, please contact phophen's Data Protection Officer using the contact details in Section 13. phophen will respond to all verified requests within the timeframes prescribed by the DPA and NPC regulations.

phophen uses cookies and similar tracking technologies to operate the Platform, enhance user experience, maintain session security, and analyse aggregate usage patterns. The categories of cookies used by phophen include:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, game preferences, and phophen login state across sessions.
• Analytics Cookies: Used to collect aggregate, anonymised data about how players use the phophen Platform, to help phophen improve platform performance and user experience.

You may control non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of the phophen Platform. phophen does not use third-party advertising cookies or sell cookie data to advertising networks.

The phophen Platform is strictly intended for persons who are 21 years of age or older. phophen does not knowingly collect personal data from individuals under 21 years of age. Age verification is conducted at the point of account registration and at withdrawal as part of KYC compliance.

phophen reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine laws, NPC guidance, or PAGCOR regulatory requirements. The date of the most recent revision is indicated at the top of this Policy.

When material changes are made to this Policy, phophen will notify registered players via the email address on file or by prominently displaying a notice on the phophen Platform. Your continued use of the Platform following any update constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.