ph889 Privacy Policy —
How We Handle Your Personal Data

1 Introduction

ph889 ("we", "our", "us") operates the online gaming platform accessible at ph889.cam ("the Platform"). We act as the Personal Information Controller for all personal data collected from users ("you", "the Player", "the Data Subject") of the ph889 platform.

This Privacy Policy ("Policy") describes our practices regarding the collection, use, storage, disclosure, and protection of personal data in connection with your use of ph889. This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR") as administered by the National Privacy Commission ("NPC") of the Philippines.

By registering an account on ph889 or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read together with the ph889 Terms & Conditions, which are incorporated by reference.

2 Data Controller Information

As the Personal Information Controller under the Data Privacy Act of 2012, ph889 is responsible for determining the purposes and means by which your personal data is processed. ph889 has registered its data processing systems with the National Privacy Commission as required under applicable regulations.

ph889 has appointed a Data Protection Officer ("DPO") who is responsible for ensuring compliance with the DPA and this Policy, handling data subject rights requests, and serving as the point of contact for the NPC on privacy-related matters. The DPO may be contacted at the details provided in Section 15 of this Policy.

3 Personal Data We Collect

ph889 collects the following categories of personal data in connection with your use of the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification;
• Date of birth (for age verification — must be 21 or older);
• Email address and mobile phone number;
• Residential address (province, city/municipality);
• Nationality and country of residence.

3.2 KYC & Identity Verification Data

• Government-issued ID type and document number (PhilSys, Passport, Driver's License, UMID, SSS ID, Voter's ID, or PRC ID);
• Scanned or photographed copies of identification documents submitted for KYC verification;
• Selfie or liveness check images submitted during identity verification processes.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment method references;
• GCash or Maya account identifiers (non-sensitive reference numbers only — ph889 does not store full wallet credentials);
• Bank account details provided for withdrawal processing (BPI, BDO, Metrobank);
• Bonus and promotional activity history.

3.4 Gaming Activity Data

• Game session logs including games played, wager amounts, and outcomes;
• Sports betting selections, odds accepted, and settlement records;
• Responsible gaming tool settings (deposit limits, session timers, cooling-off periods) and self-exclusion records.

3.5 Technical & Device Data

• IP address and approximate geolocation at time of login;
• Device type, operating system, and browser type;
• Session logs and access timestamps;
• Cookie identifiers and similar tracking technologies (see Section 8).

3.6 Communications Data

• Customer support chat transcripts and email correspondence;
• Feedback, complaints, and dispute records;
• Marketing preference settings and opt-in/opt-out records.

4 How We Collect Your Data

ph889 collects personal data through the following channels:

• Direct provision: Information you submit during account registration, KYC verification, deposit/withdrawal forms, customer support contacts, and promotional sign-ups;
• Platform activity: Data generated automatically as you use ph889 — game sessions, betting activity, login events, and navigation behavior;
• Payment processors: Transaction reference data returned by GCash, Maya, and banking partners upon processing of deposits or withdrawals;
• Technical systems: IP address, device identifiers, and session data collected automatically by ph889's servers and security systems;
• Third-party verification: Identity verification data returned by ph889's KYC service provider following document review;
• Cookies and tracking technologies: Behavioral and session data collected via cookies and similar technologies as described in Section 8.

5 Lawful Basis for Processing

ph889 processes your personal data on the following lawful bases under the Data Privacy Act of 2012:

6 How ph889 Uses Your Personal Data

ph889 uses your personal data for the following specific purposes:

• To create, verify, and manage your ph889 account throughout its lifecycle;
• To process deposits, withdrawals, and bonus transactions accurately and securely;
• To conduct mandatory KYC and age verification (21+ requirement) in compliance with PAGCOR licensing conditions;
• To detect, investigate, and prevent fraud, money laundering, collusion, and other prohibited activities on the Platform;
• To report covered and suspicious transactions to the Anti-Money Laundering Council (AMLC) as required under Republic Act No. 9160 and its amendments;
• To administer responsible gaming tools including deposit limits, session timers, cooling-off periods, and self-exclusion programs;
• To provide customer support, resolve disputes, and respond to regulatory inquiries;
• To send service communications including account activity notifications, security alerts, and policy update notices;
• To send promotional communications, bonus offers, and marketing materials — only where you have provided explicit opt-in consent, which you may withdraw at any time;
• To analyze platform usage patterns for product improvement, game curation, and user experience optimization;
• To comply with all applicable Philippine laws, PAGCOR regulatory requirements, and lawful orders from government authorities.

7 Sharing & Disclosure of Personal Data

ph889 does not sell, rent, or trade your personal data. We disclose personal data only in the following circumstances:

• Service providers: ph889 engages third-party companies to assist in platform operations, including KYC verification providers, payment processors (GCash, Maya, BPI, BDO, Metrobank), game studios, cloud infrastructure providers, and customer support tools. These providers are bound by Data Processing Agreements and are prohibited from using your data for purposes beyond what ph889 has authorized;
• Regulatory authorities: ph889 discloses data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities as required by law or pursuant to valid legal process;
• Law enforcement: ph889 cooperates with the Philippine National Police (PNP), National Bureau of Investigation (NBI), and other agencies in response to lawful requests, court orders, or warrants;
• Business transfers: In the event of a merger, acquisition, or sale of ph889's business, personal data may be transferred as part of the transaction, subject to the same privacy protections. Affected users will be notified before any transfer;
• Your consent: ph889 may share your data with third parties not listed above if you have given explicit, informed consent to that specific disclosure.

8 Cookies & Tracking Technologies

ph889 uses cookies and similar tracking technologies to operate the Platform, maintain session security, analyze usage, and deliver relevant content. The following types of cookies are used:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair platform functionality and may prevent you from accessing your ph889 account. Marketing cookies are deployed only with your explicit consent and may be withdrawn at any time through your account settings or browser controls.

9 Data Security Measures

ph889 implements a comprehensive set of technical, organizational, and physical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• Encryption: 256-bit SSL/TLS encryption for all data in transit; AES-256 encryption for sensitive data fields at rest;
• Access controls: Role-based access controls limiting employee access to personal data on a strict need-to-know basis; multi-factor authentication for all administrative system access;
• Monitoring: 24/7 security monitoring, intrusion detection systems, and automated anomaly detection on all platform infrastructure;
• Penetration testing: Regular third-party security audits and penetration testing of ph889's platform, APIs, and data infrastructure;
• Incident response: A documented data breach response plan including mandatory notification to the National Privacy Commission within 72 hours of discovering a qualifying personal data breach, and notification to affected data subjects as required by law;
• Staff training: All ph889 personnel with access to personal data undergo regular data privacy training and are bound by confidentiality obligations.

Despite these measures, no security system is impenetrable. ph889 cannot guarantee absolute security of data transmitted over the internet. You are encouraged to use strong, unique passwords for your ph889 account and to enable two-factor authentication in your account settings.

10 Data Retention

ph889 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, subject to applicable legal retention requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, ph889 will securely delete or irreversibly anonymize the relevant personal data in accordance with its data disposal procedures.

11 Children's Privacy & Age Restriction

ph889 is strictly prohibited to individuals under 21 years of age, consistent with Philippine gaming law. ph889 does not knowingly collect or process personal data from persons under 21 years of age.

All account registrations are subject to mandatory age verification through government-issued identification documents. Accounts where the registered holder is subsequently found to be under 21 years of age will be immediately closed, associated balances forfeited, and the matter reported to PAGCOR as required. Any personal data collected in connection with an underage account will be deleted following the completion of the regulatory reporting obligations.

If you are a parent or guardian and believe a minor has registered on ph889 using false information, please contact our DPO immediately at [email protected] so that we may take immediate action.

12 Cross-Border Data Transfers

ph889's primary data processing infrastructure is located within the Philippines. However, certain service providers — including cloud infrastructure, KYC verification, and game studio platforms — may process data in other jurisdictions, including Singapore, Hong Kong, and EU-based data centers.

When personal data is transferred outside the Philippines, ph889 ensures that appropriate safeguards are in place to maintain data protection standards equivalent to those required under the Data Privacy Act of 2012. These safeguards include:

• Data Processing Agreements incorporating NPC-compliant data transfer provisions;
• Transfer to jurisdictions with adequate data protection laws as recognized by the NPC;
• Binding corporate rules or standard contractual clauses where applicable.

Details of specific cross-border transfer arrangements are available from the ph889 Data Protection Officer upon written request.

13 Exercising Your Data Privacy Rights

To exercise any of the rights described in this Policy, you may submit a written request to ph889's Data Protection Officer using the contact details in Section 15. Your request should include:

• Your full name and registered email address (to verify your identity as the account holder);
• A clear description of the right you wish to exercise and the specific data concerned;
• For erasure or objection requests, the reason for your request.

ph889 will respond to all data rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. Complex requests may require an extension, which ph889 will communicate to you in writing within the initial 15-day period.

Some rights are subject to limitations where ph889 has a legal obligation to retain or continue processing data — for example, AMLA transaction records cannot be deleted on request during the mandatory retention period. Where a limitation applies, ph889 will inform you of the reason and any available alternatives.

If you are unsatisfied with ph889's response to a data rights request, you may escalate your complaint to the National Privacy Commission at privacy.gov.ph (for informational reference only — not a clickable link per our site rules).

14 Amendments to This Privacy Policy

ph889 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, PAGCOR regulatory requirements, or platform features. When material changes are made, ph889 will notify registered players via email to their registered address and/or via an in-platform notice at least seven (7) days before the amended Policy takes effect, except where immediate changes are required for security or legal compliance reasons.

The "Last Updated" date at the top of this page indicates when the current version of the Policy was published. The current version is always available at ph889.cam/privacy-policy. We encourage you to review this Policy periodically to stay informed about how ph889 protects your personal data.

Continued use of ph889 following notification of material changes constitutes acceptance of the revised Policy. If you do not agree with the amended Policy, you must discontinue use of ph889 and may request account closure as described in the Terms & Conditions.

15 Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or ph889's data processing practices, please contact ph889's Data Protection Officer:

• DPO Email: [email protected] — include "Data Privacy" or "DPO Request" in the subject line
• Platform Support: Live chat available 24/7 within your ph889 account dashboard — select "Privacy & Data" from the support menu
• Response Time: Written DPO requests acknowledged within 3 business days; substantive response within 15 business days per NPC guidelines