Privacy Policy – How ph364 Protects Your Personal Data

1. Overview

1.1 This Privacy Policy ("Policy") describes how ph364 ("ph364," "we," "us," "our") collects, uses, stores, discloses, and protects the personal information of users ("you," "your," "Player") who access or use the ph364 online gaming platform available at ph364.club.

1.2 ph364 is committed to protecting the privacy and personal data of all its users in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC).

1.3 This Policy should be read together with the ph364 Terms & Conditions, which govern your use of the platform. Capitalized terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

1.4 By registering an account, making a deposit, or otherwise using the ph364 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the ph364 platform.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012 and this Policy, ph364 acts as the Personal Information Controller (PIC) in respect of the personal data it collects directly from users of the ph364 platform.

2.2 Where ph364 engages third-party service providers (such as payment processors, KYC verification providers, and game suppliers) to process personal data on its behalf, those parties act as Personal Information Processors (PIPs) and are bound by data processing agreements that require them to handle personal data in accordance with applicable law and ph364's instructions.

2.3 ph364 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data privacy laws. Contact details for the DPO are provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 ph364 collects the following categories of personal data from users:

3.1 Identity and Contact Data

• Full legal name as it appears on government-issued identification;
• Date of birth (for age verification — 21+ requirement);
• Nationality and country of residence;
• Mobile number and email address;
• Residential address (barangay, city/municipality, province, ZIP code).

3.2 Identity Verification (KYC) Data

• Copies of government-issued photo identification (Philippine Passport, Driver's License, UMID, PhilSys National ID, SSS/GSIS ID, Voter's ID);
• Proof of address documents (utility bills, bank statements);
• Selfie or liveness check images used for identity verification;
• Source of funds declarations where required by anti-money laundering regulations.

3.3 Financial and Transaction Data

• GCash or PayMaya account reference (mobile number associated with the e-wallet);
• Bank account details for bank transfer transactions (account name, bank name, account number);
• Debit card details (card number is tokenized and not stored in full by ph364);
• Deposit and withdrawal history, transaction amounts, and timestamps;
• Account balance and bonus balance information.

3.4 Gaming and Behavioral Data

• Game session history, wager amounts, game outcomes, and win/loss records;
• Bonus claims, wagering progress, and promotion participation history;
• Responsible gaming tool settings (deposit limits, self-exclusion status);
• Customer support interaction records, including chat transcripts and email correspondence.

3.5 Technical and Device Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, browser type and version;
• Session timestamps, login history, and access logs;
• Cookie identifiers and similar tracking technology data (see Section 11).

4. How We Collect Personal Data

4.1 ph364 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical data collected automatically when you access the ph364 platform, including through cookies, web beacons, and server logs;
• Third-party sources: Identity verification data from KYC service providers; fraud and sanctions screening data from compliance databases; payment confirmation data from payment processors such as GCash, PayMaya, and banking partners.

4.2 ph364 does not purchase personal data from data brokers or third-party marketing lists. All personal data collected by ph364 is obtained directly from the data subject or from service providers engaged to assist with platform operations.

5. Purposes of Processing

5.1 ph364 processes personal data for the following purposes:

5.2 ph364 will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

6. Legal Basis for Processing

6.1 ph364 processes personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between ph364 and the player (account management, payment processing, game provision);
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, KYC requirements, and regulatory reporting obligations;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by the data subject's rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, freely given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Data Sharing and Disclosure

7.1 ph364 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared only in the following circumstances:

• Payment processors: GCash, PayMaya, and banking partners receive the minimum data necessary to process your transactions;
• KYC and AML service providers: Identity verification and sanctions screening providers receive identity documents and personal details to fulfill regulatory compliance obligations;
• Game suppliers: Licensed game providers may receive a pseudonymous player identifier and session data necessary to deliver game services;
• Regulatory authorities: ph364 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement agencies, or other competent authorities when required by law or valid legal process;
• Professional advisors: Legal counsel, auditors, and compliance consultants under strict confidentiality obligations;
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections.

7.2 All third-party processors engaged by ph364 are required to enter into data processing agreements that obligate them to process personal data only on ph364's instructions, implement appropriate security measures, and comply with applicable data privacy laws.

8. Data Retention

8.1 ph364 retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, in compliance with AML record-keeping requirements;
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Customer support records: Retained for three (3) years from the date of the interaction;
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year for audit purposes;
• Technical logs: Retained for twelve (12) months unless required for longer periods for security or legal purposes.

8.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with ph364's data disposal procedures.

9. Security Measures

9.1 ph364 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and the ph364 platform is encrypted using TLS 1.2 or higher (256-bit SSL);
• Encryption at rest: Sensitive personal data stored in ph364 databases is encrypted at rest using industry-standard encryption algorithms;
• Access controls: Access to personal data is restricted to authorized personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication;
• Payment security: Card data is tokenized and processed through PCI-DSS compliant payment infrastructure. ph364 does not store full card numbers;
• Penetration testing: ph364 conducts regular security assessments and penetration tests to identify and remediate vulnerabilities;
• Incident response: ph364 maintains a data breach response plan and will notify affected users and the National Privacy Commission within the timeframes required by law in the event of a personal data breach.

9.2 While ph364 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying ph364 immediately if you suspect unauthorized access to your account.

10. Your Data Privacy Rights

10.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph364:

• Right to be informed: The right to be informed of how your personal data is being collected and processed — which this Policy fulfills;
• Right of access: The right to request a copy of the personal data ph364 holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data, subject to ph364's legal retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation;
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

10.2 To exercise any of the above rights, please contact the ph364 Data Protection Officer using the contact details in Section 14. ph364 will respond to all verified requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days with notice to you.

10.3 ph364 may need to verify your identity before processing a data rights request to ensure that personal data is not disclosed to unauthorized parties.

11. Cookies and Tracking Technologies

11.1 ph364 uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies and security tokens. These cannot be disabled without impairing platform functionality;
• Functional cookies: Remember your preferences (language, display settings) to improve your experience;
• Analytics cookies: Collect aggregated, anonymized data about how users interact with the platform to help ph364 improve its services. No personally identifiable information is included in analytics reports;
• Marketing cookies: Used to deliver relevant promotional content. These are only set with your explicit consent.

11.2 You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the ph364 platform. Strictly necessary cookies cannot be disabled through browser settings as they are essential to platform operation.

11.3 ph364 does not use third-party advertising networks or cross-site tracking technologies that share your data with unaffiliated advertisers.

12. Minors and Age Restriction

12.1 The ph364 platform is strictly restricted to individuals who are 21 years of age or older. ph364 does not knowingly collect personal data from persons under 21 years of age.

12.2 If ph364 discovers or has reason to believe that personal data has been collected from a person under 21 years of age, it will immediately close the associated account, delete the personal data collected, and return any deposited funds to the verified payment source.

12.3 If you are a parent or guardian and believe that your child under 21 has registered on the ph364 platform, please contact ph364 support immediately using the contact details in Section 14.

13. Changes to This Privacy Policy

13.1 ph364 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or ph364's data processing practices. The most current version of this Policy will always be available at ph364.club/privacy-policy.

13.2 Where changes are material, ph364 will notify registered users via the email address or mobile number on file at least seven (7) days before the amended Policy takes effect. Your continued use of the ph364 platform after the effective date of any amendment constitutes acceptance of the revised Policy.

13.3 We encourage you to review this Policy periodically to stay informed about how ph364 is protecting your personal data.

14. Contact and Data Protection Officer

14.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ph364, please contact our Data Protection Officer through the following channels:

14.2 ph364 aims to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within thirty (30) days of receipt.

14.3 If you are not satisfied with ph364's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information on how to file a complaint is available on the NPC's official website.

14.4 ph364 serves players across the Philippines, including Manila, Cebu, Davao, Quezon City, Makati, and all other regions, and is committed to upholding the data privacy rights of all Filipino users.