ph97 Privacy Policy
How We Handle Your Data

Introduction

ph97 takes data privacy seriously — not as a legal formality, but as a genuine commitment to the Filipino players who trust us with their personal information. Every player who registers on ph97 shares sensitive data: their real name, mobile number, government ID, and financial transaction records. That data enables ph97 to operate securely, comply with PAGCOR requirements, and deliver a personalised gaming experience. In return, ph97 is obligated — legally and ethically — to handle that data with the highest standard of care.

This Policy has been drafted in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines. It also reflects ph97's obligations as a PAGCOR-licensed online gaming operator, which includes specific data handling requirements set by PAGCOR's regulatory framework for online gaming platforms.

If you are reading this Policy because you have a specific concern about your data — a correction request, a deletion request, or a question about what information ph97 holds about you — please proceed directly to Section 11 (Your Rights) and Section 15 (Contact the DPO). ph97's Data Protection Officer (DPO) handles all data subject inquiries and will respond within fifteen (15) business days.

Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, the data controller responsible for the personal data of ph97 Players is:

ph97 has registered a Data Protection Officer (DPO) in accordance with Section 21 of RA 10173. The DPO is responsible for ensuring ph97's ongoing compliance with applicable data privacy law, handling data subject requests, and maintaining ph97's personal information inventory and privacy management programme. Contact details for the DPO are provided in Section 15.

Data We Collect

ph97 collects the following categories of personal data, depending on your level of account activity and the services you use:

How We Collect Data

ph97 collects personal data through the following channels and mechanisms:

4.1 Direct Collection. The majority of personal data ph97 holds is provided directly by you — through the registration form, KYC document uploads, deposit and withdrawal requests, contact with customer support, and voluntary profile updates. ph97 collects only the information necessary for the stated purpose at each collection point.

4.2 Automated Technical Collection. When you access ph97.asia, ph97's servers automatically collect certain technical data including your IP address, device type, browser version, and operating system. This data is collected via standard server logs and session management systems. This information is used for security monitoring, fraud detection, and platform optimisation — not for building individual advertising profiles.

4.3 Cookies and Similar Technologies. ph97 uses session cookies and persistent cookies to manage login sessions, maintain account security, and understand aggregate platform usage patterns. These are described in detail in Section 8.

4.4 Third-Party Payment Processors. When you transact via GCash, PayMaya, or a Philippine bank, ph97 receives a transaction confirmation record from the payment processor, which typically includes the transaction reference number, amount, timestamp, and a partial account identifier. ph97 does not receive or store full payment account passwords or full card numbers.

4.5 Third-Party KYC Verification Partners. ph97 may use regulated third-party identity verification services to assist with KYC document validation. These partners are bound by data processing agreements that require them to handle data only for the KYC purpose and to maintain security standards equivalent to or exceeding ph97's own requirements.

Purpose & Legal Basis

ph97 processes personal data only for specific, legitimate purposes. Under RA 10173, data processing must be based on one or more of the following lawful grounds: the performance of a contract, compliance with a legal obligation, legitimate interests, or the data subject's consent. The table below sets out ph97's primary processing purposes and their corresponding legal basis:

• Account creation and management — necessary for the performance of the contract between ph97 and the Player (i.e., providing gaming services).
• KYC identity and age verification — required by PAGCOR regulations and Philippine anti-money laundering law (RA 9160, as amended). Legal basis: compliance with a legal obligation.
• Processing deposits and withdrawals — necessary for performance of contract; also required for AMLC reporting obligations on transactions above prescribed thresholds.
• Game session management and game history — necessary for contract performance; also required by PAGCOR's audit and reporting requirements for licensed operators.
• Fraud detection and security monitoring — legitimate interest of ph97 in maintaining platform integrity, preventing financial crime, and protecting all players from fraudulent activity.
• Customer support — necessary for contract performance; legitimate interest in resolving player disputes and maintaining service quality.
• Responsible gaming monitoring — required by PAGCOR's responsible gaming framework; legitimate interest in player welfare and regulatory compliance.
• Regulatory reporting to PAGCOR and AMLC — compliance with legal obligations as a licensed gaming operator and a covered person under anti-money laundering law.
• Marketing communications — based on your explicit prior consent only. You may withdraw marketing consent at any time through your Account Settings or by contacting ph97 support.
• Platform analytics and improvement — legitimate interest; based on aggregated, anonymised data where possible. Individual profiling for non-gaming commercial purposes does not occur without separate consent.

Data Sharing

ph97 does not sell, rent, or trade personal data. ph97 shares data only with the following categories of recipients, and only to the extent necessary for the specified purpose:

6.1 Regulatory Authorities. ph97 is required by law to report certain data to PAGCOR (player activity reports, incident reports), the Anti-Money Laundering Council (AMLC, for covered and suspicious transaction reports), and the National Privacy Commission (data breach notifications, compliance reports). These disclosures are mandatory and do not require player consent.

6.2 Payment Processors. Transaction data is shared with GCash (G-Xchange, Inc.), PayMaya (Voyager Innovations, Inc.), and partner Philippine banks (BPI, BDO, Metrobank) solely for the purpose of processing the specific deposit or withdrawal transaction initiated by the Player. These entities operate under their own privacy policies and applicable BSP regulations.

6.3 KYC and Identity Verification Partners. Document images and identity data may be shared with accredited third-party KYC verification providers for the sole purpose of verifying the Player's identity and age. These providers are contractually bound to use data only for the verification purpose and to maintain appropriate security controls.

6.4 Game Content Providers. Game studios whose content appears on ph97 (e.g., Pragmatic Play, NetEnt, Microgaming) receive only the data technically necessary to run the game session — typically a session token, game round ID, and wager/outcome values. These providers do not receive your name, mobile number, or KYC data through the game integration.

6.5 Cloud and Infrastructure Providers. ph97 uses reputable cloud infrastructure providers to host its platform. These providers act as data processors under processing agreements with ph97 and may not use your data for any purpose beyond providing infrastructure services to ph97.

6.6 Law Enforcement. ph97 may disclose data to law enforcement agencies where required to do so by a valid court order, legal process, or where ph97 has a good-faith belief that disclosure is necessary to prevent imminent harm or to cooperate with an investigation into criminal activity involving the ph97 platform.

International Data Transfers

ph97's primary data storage and processing infrastructure is located within the Philippines. In certain limited circumstances — specifically, where ph97 uses internationally based game studios, cloud infrastructure with global data centres, or KYC verification providers operating internationally — personal data may be transferred to or processed in jurisdictions outside the Philippines.

Any international transfer of personal data by ph97 is conducted in accordance with Section 21 of RA 10173 and NPC Advisory Opinion on cross-border data flows. ph97 requires all recipients of internationally transferred data to:

• Be located in a jurisdiction with adequate data protection laws, as determined by the NPC, or to be subject to binding contractual clauses requiring equivalent protection;
• Process the transferred data only for the specific purpose for which the transfer was made;
• Not further transfer the data to additional third parties without ph97's prior written approval;
• Notify ph97 of any data breaches affecting transferred data within seventy-two (72) hours of discovery.

Players who wish to know whether their specific data has been transferred internationally may submit a data subject access request to ph97's DPO as described in Section 15.

Cookies & Tracking

ph97 uses cookies and similar browser technologies to operate platform functions and improve the player experience. The following cookie categories are used:

• Strictly Necessary Cookies: Required for core platform functionality, including maintaining login sessions, storing your authentication token, and enabling game sessions to run securely. These cookies cannot be disabled without breaking the platform. They do not collect data for advertising purposes.
• Functional Cookies: Remember your preferences such as language selection, game lobby view settings, and responsible gaming limit displays. These improve the experience of returning players but are not essential to basic platform operation.
• Analytics Cookies: Aggregate, anonymised data about platform usage — page visits, game lobby navigation patterns, feature adoption rates — used to guide ph97's product development. Individual players are not tracked or profiled through these cookies. ph97 uses privacy-respecting analytics tools that do not share data with advertising networks.
• Security Cookies: Used for fraud detection and device recognition purposes — specifically, to determine whether a login attempt is from a previously verified device. These contribute directly to Account security.

ph97 does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. ph97.asia does not serve advertising from third-party networks.

Data Retention

ph97 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data (identity, contact, financial, gaming data) — retained for the full duration of the Player's active account relationship with ph97, plus a mandatory post-closure retention period.
• Post-Closure Retention — following account closure (whether voluntary or by ph97), ph97 retains player records for a minimum of five (5) years from the date of closure, as required by PAGCOR regulations and the Anti-Money Laundering Act for record-keeping obligations.
• KYC Document Images — retained for the duration of the account relationship plus five (5) years post-closure, in compliance with AMLC customer due diligence record-keeping requirements.
• Transaction Records — retained for a minimum of five (5) years from the date of the transaction, as required by BSP and AMLC regulations applicable to online payment intermediaries.
• Customer Support Records — retained for three (3) years from the date of the interaction, to support dispute resolution and regulatory audit requirements.
• Marketing Consent Records — retained for three (3) years from the date of the consent or withdrawal, as evidence of consent status for regulatory purposes.
• Anonymised Analytics Data — may be retained indefinitely in fully anonymised, aggregated form with no re-identification risk.

Upon expiry of the applicable retention period, ph97 will securely delete or anonymise personal data using methods that prevent recovery, unless further retention is required by a specific legal order or regulatory direction.

Security Measures

ph97 implements a layered security programme to protect player data against unauthorised access, disclosure, alteration, and loss. Key measures include:

• 256-Bit SSL/TLS Encryption in Transit: All data transmitted between your device and ph97's servers is encrypted using TLS 1.2 or higher. This includes login credentials, payment data, and game session data.
• Encrypted Storage at Rest: Personal data and financial records stored in ph97's databases are encrypted at rest. Encryption keys are managed separately from the data they protect and are rotated on a regular schedule.
• Role-Based Access Control (RBAC): ph97 staff access to player data is governed by RBAC — each staff member can only access data categories required for their specific role. Access to sensitive personal information (KYC documents, financial records) is restricted to a limited set of authorised personnel.
• Access Logging and Monitoring: All staff access to player records is logged with timestamp, user identity, and data category accessed. Logs are reviewed regularly for anomalous access patterns.
• Data Breach Response Plan: ph97 maintains a documented data breach response procedure. In the event of a personal data breach affecting Philippine-resident players, ph97 will notify the National Privacy Commission and affected players within seventy-two (72) hours of discovery, in accordance with NPC Circular 16-03.
• Third-Party Security Assessments: ph97's security infrastructure undergoes periodic third-party penetration testing and security audits. Findings are remediated on a risk-prioritised schedule.

Your Rights

Under the Data Privacy Act of 2012 (RA 10173), Filipino players have the following rights in relation to their personal data held by ph97:

To exercise any of the above rights, submit a written request to ph97's Data Protection Officer at the contact details in Section 15. Please include your Account username and a description of your request. ph97 will respond within fifteen (15) business days of receiving a complete request. Identity verification may be required before processing certain requests.

If you are not satisfied with ph97's response to a data subject request, you have the right to file a complaint with the National Privacy Commission of the Philippines through the NPC's official complaint procedures.

Children's Privacy

ph97 is strictly a platform for adults aged twenty-one (21) years and above in accordance with PAGCOR regulations. ph97 does not knowingly collect personal data from individuals below this age. Age verification is conducted as part of the KYC process for all registered accounts.

If ph97 discovers that personal data has been collected from an individual who was below the minimum age at the time of registration, ph97 will immediately close the Account, return any deposits net of bonuses received, void any winnings, and permanently delete all personal data associated with the underage account from ph97's systems — subject only to any legally mandated reporting obligations.

If you believe your child or a minor has registered a ph97 account without satisfying the age requirement, please contact ph97's Data Protection Officer immediately with supporting information. ph97 will investigate and act promptly.

Marketing Communications

ph97 will only send you promotional communications — including SMS messages about bonuses and offers, and email newsletters (if your email is registered) — if you have explicitly opted in to receiving such communications. Marketing consent is not pre-selected during registration; it is a voluntary, separate opt-in action.

You may withdraw consent for marketing communications at any time through any of the following methods:

• Toggling off the "Marketing Communications" option in your ph97 Account Settings panel;
• Replying STOP to any ph97 marketing SMS message;
• Contacting ph97 customer support via live chat and requesting removal from the marketing list.

Withdrawal of marketing consent takes effect within two (2) business days. You may continue to receive non-promotional transactional messages — such as OTP codes, withdrawal confirmations, and security alerts — regardless of your marketing preference, as these are necessary for Account operation.

Policy Updates

ph97 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or ph97's data processing practices. The "Last Updated" date at the top of this document indicates when the current version took effect.

Material changes to this Policy — specifically those that affect the types of data collected, the purposes for processing, or the rights available to Players — will be notified to Players via SMS to their registered mobile number at least seven (7) days before the change takes effect. Non-material corrections, clarifications, and formatting updates may be made without prior notice.

The current version of this Policy is always accessible at ph97.asia/privacy-policy. By continuing to use the ph97 platform after a policy update takes effect, you accept the revised Policy. If you do not agree with a material change to this Policy, you may request account closure before the change takes effect.

Contact the DPO

For data subject requests, privacy concerns, or questions about this Policy, please contact ph97's Data Protection Officer through the following channels. All data-related inquiries receive a dedicated response separate from general customer support tickets.

When submitting a data subject request, please include: your ph97 Account username, a clear description of the specific right you wish to exercise or the concern you wish to raise, and any supporting information that may help ph97 verify your identity and locate the relevant records. Please do not include your full password in any written communication to ph97.