phpart Privacy Policy

This Privacy Policy ("Policy") explains how phpart ("we," "us," or "our") — operating through the website at phpart.org and all associated subdomains and mobile interfaces (collectively, the "Platform") — collects, processes, stores, shares, and protects personal data provided by or relating to users of the Platform ("you" or "the Player").

phpart acts as the data controller with respect to the personal data it collects directly from Players. Where phpart engages third-party service providers to process personal data on its behalf, those providers act as data processors under phpart's instruction and are bound by appropriate data processing agreements.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines ("NPC"). This Policy supplements phpart's Terms & Conditions and should be read in conjunction with them.

By registering a phpart account and using the Platform, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not consent, you should not register or use the Platform.

phpart collects the following categories of personal data from Players:

2.1 Registration & Identity Data. Full legal name; date of birth; nationality; government-issued identification number (e.g., PhilSys National ID, SSS, passport); registered mobile number; email address; and username chosen at registration.

2.2 KYC Verification Data. Copies of government-issued identification documents; selfie or live photo for facial verification; proof of residential address (e.g., utility bill, barangay certificate); and where applicable, source-of-funds documentation as required by Philippine AML regulations.

2.3 Financial & Transaction Data. Deposit and withdrawal amounts and timestamps; payment method details (e.g., GCash mobile number, Maya account reference, bank account details); transaction reference numbers; and wallet balance history.

2.4 Gaming Activity Data. Game sessions, wager amounts, game outcomes, bet history, bonus redemption records, and responsible gaming tool activation records (e.g., deposit limit settings, self-exclusion requests).

2.5 Device & Technical Data. IP address; device type and operating system; browser type and version; session duration and login timestamps; and geolocation data (city-level) derived from IP address.

2.6 Communications Data. Records of communications between you and phpart's customer support team, including live chat transcripts, support ticket content, and email correspondence.

2.7 Marketing Preferences. Your opt-in or opt-out status for phpart marketing communications, and your communication channel preferences where applicable.

phpart collects personal data through the following means:

• Direct provision: Data you submit during account registration, KYC verification, deposit or withdrawal requests, or support communications;
• Automated collection: Technical data collected automatically via cookies, session tracking, and server logs when you access or use the Platform;
• Third-party providers: Identity verification and KYC data validated through licensed third-party verification providers; payment data transmitted through integrated payment gateways (GCash, Maya, BPI, BDO, Metrobank, UnionBank, and others);
• Regulatory sources: Where required by Philippine AML regulations, phpart may cross-reference Player data against publicly available watchlists, sanctions lists, or PAGCOR-mandated databases.

phpart uses collected personal data for the following purposes:

• Account management: Creating, maintaining, and administering your phpart account; verifying your identity at registration and KYC stages; authenticating phpart login sessions;
• Service delivery: Processing deposits, withdrawals, and wagers; delivering game outcomes; awarding bonuses and loyalty points; providing customer support;
• Legal & regulatory compliance: Meeting obligations under Philippine AML law (RA 9160 as amended), PAGCOR regulations, tax reporting requirements, and NPC-mandated data governance standards;
• Fraud prevention & security: Detecting, preventing, and investigating fraudulent activity, collusion, unauthorized account access, money laundering, and other prohibited conduct;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators; administering deposit limits, loss limits, cool-off periods, and self-exclusion as activated by you or required by phpart's responsible gaming policy;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to Players who have opted in to marketing communications. You may opt out at any time via your account settings;
• Platform improvement: Analysing aggregated and anonymized usage data to improve Platform performance, game selection, and user experience.

phpart processes personal data on the following legal bases as recognized under the Philippine Data Privacy Act:

• Contractual necessity: Processing required to perform phpart's obligations under the Terms & Conditions you agreed to at registration (e.g., account creation, payment processing, game delivery);
• Legal obligation: Processing required to comply with Philippine law, including AML reporting obligations, PAGCOR licensing requirements, and tax law;
• Legitimate interest: Processing for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights;
• Consent: Processing for marketing communications, where you have provided explicit opt-in consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

phpart does not sell or rent your personal data. phpart may share personal data with the following categories of recipients only to the extent necessary for the stated purpose:

6.1 Payment Processors. GCash (Mynt), Maya (Paymaya Philippines), BPI, BDO, Metrobank, UnionBank, and other payment partners receive transaction data necessary to process deposits and withdrawals. These parties act as independent data controllers for their own services and are subject to their own privacy policies and BSP oversight.

6.2 KYC & Identity Verification Providers. Licensed third-party KYC providers receive identity and document data solely for the purpose of verifying Player identity as required by PAGCOR regulations and Philippine AML law.

6.3 Game Software Providers. Game studios providing software on the phpart Platform receive session and outcome data necessary for game operation, RTP auditing, and jackpot management. Personal identifying information beyond Player ID references is not shared with game providers.

6.4 Regulatory Authorities. phpart is required by Philippine law to disclose certain Player and transaction data to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities upon lawful request or as part of mandatory reporting obligations.

6.5 Law Enforcement. phpart may disclose personal data to Philippine law enforcement authorities where required by court order, subpoena, or other compulsory legal process, or where phpart reasonably believes disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

6.6 Corporate Transactions. In the event of a merger, acquisition, or sale of phpart's business or assets, personal data held by phpart may be transferred to the acquiring entity, subject to that entity assuming phpart's data protection obligations under this Policy.

phpart retains personal data for the following periods, or as otherwise required by applicable Philippine law:

• Account data: For the duration of your active phpart account, plus five (5) years following account closure, to satisfy AML record-keeping requirements under RA 9160;
• KYC documents: Five (5) years from the date of account closure or the date of the last transaction, whichever is later;
• Transaction records: Five (5) years from the date of each transaction, in accordance with PAGCOR and AMLC requirements;
• Support communications: Two (2) years from the date of the most recent communication in a support thread;
• Marketing preferences: Until you withdraw consent or close your account, whichever comes first.

Upon expiry of the applicable retention period, phpart will securely delete or irreversibly anonymize the relevant personal data unless continued retention is required by a specific legal obligation or active legal proceedings.

phpart implements appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS 1.3 encryption for all data transmitted between your device and phpart's servers;
• AES-256 encryption for personal data stored at rest in phpart's databases;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for phpart personnel accessing production systems;
• Regular security audits and penetration testing conducted by independent third-party security firms;
• Intrusion detection and anomaly monitoring systems operating 24/7.

While phpart takes all reasonable steps to protect your personal data, no security system is impenetrable. phpart cannot guarantee absolute security of data transmitted over the internet. You are responsible for maintaining the security of your phpart login credentials.

9.1 What We Use. phpart uses cookies and similar tracking technologies (including session tokens, local storage, and analytics identifiers) on the Platform to: maintain your phpart login session; remember your preferences; detect and prevent fraud; and analyse aggregate Platform usage patterns.

9.2 Types of Cookies. Essential cookies are required for the Platform to function and cannot be disabled. They include session authentication tokens and security cookies. Analytics cookies collect anonymized usage data to help phpart understand how Players navigate the Platform. Preference cookies store your language and display settings.

9.3 Third-Party Analytics. phpart may use third-party analytics services to process aggregated, anonymized Platform usage data. These services do not receive personally identifying information.

9.4 Cookie Control. You may control non-essential cookies through your browser settings. Disabling essential cookies will prevent you from using core Platform features including phpart login and gameplay.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phpart:

• Right to be informed: The right to be told what personal data phpart holds about you and how it is used — which is the primary purpose of this Policy;
• Right of access: The right to request a copy of the personal data phpart holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations;
• Right to data portability: The right to receive your personal data in a structured, machine-readable format;
• Right to object: The right to object to processing based on legitimate interest, including profiling for marketing purposes;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), the right to withdraw that consent at any time;
• Right to damages: The right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data, in accordance with Section 16(f) of the DPA.

To exercise any of these rights, contact phpart's support team. Requests will be acknowledged within 72 hours and responded to substantively within fifteen (15) business days. phpart may need to verify your identity before processing any data subject request.

The phpart Platform is strictly intended for individuals who are twenty-one (21) years of age or older, consistent with Philippine gaming regulations. phpart does not knowingly collect personal data from individuals below the age of 21. If phpart becomes aware that personal data has been collected from a minor, it will take immediate steps to delete that data and close the associated account.

Players are responsible for ensuring that minors in their household do not access the Platform using the Player's device or account credentials. Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gaming platforms.

12.1 Amendments. phpart reserves the right to update this Privacy Policy at any time to reflect changes in its data practices, applicable Philippine law, or NPC guidance. The updated Policy will be posted on this page with a revised "Last Updated" date. For material changes, phpart will endeavour to notify registered Players via their registered contact details. Continued use of the Platform following a Policy update constitutes acceptance of the revised terms.

12.2 Contact. For any questions, concerns, or data subject requests relating to this Privacy Policy or phpart's handling of your personal data, please contact phpart's Data Protection Officer through the official support channel. The phpart support contact email is: [email protected] (displayed as plain text — not a clickable link).

12.3 NPC Complaints. If you believe phpart has violated your data privacy rights and phpart's internal resolution process has not resolved your concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.