ph997 Privacy Policy

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, ph997 is the personal information controller ("Data Controller") in respect of the personal data of Players collected through and in connection with the ph997 Platform.

As Data Controller, ph997 determines the purposes and means of processing personal data submitted by Players and is responsible for ensuring that such processing is carried out in compliance with the Data Privacy Act, applicable PAGCOR regulations, and all other applicable Philippine privacy legislation.

ph997 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the National Privacy Commission. The DPO is responsible for overseeing ph997's data protection practices and serving as the primary point of contact for data subject requests and NPC inquiries. Contact details for the DPO are provided in Section 14 of this Policy.

2.1 Registration & Account Data

When you create a ph997 account, we collect the following personal information:

• Full legal name (as appearing on your government-issued ID)
• Date of birth (to verify the 21+ age requirement)
• Philippine mobile number (for OTP verification and account communications)
• Email address
• Residential address
• Username and encrypted password
• Citizenship and nationality

2.2 Identity Verification (KYC) Data

To comply with PAGCOR licensing requirements and the Philippine Anti-Money Laundering Act (Republic Act No. 9160), ph997 collects the following KYC documentation:

• Copy of a valid Philippine government-issued photo identification document (PhilSys National ID, Driver's License, Passport, SSS/GSIS ID, or equivalent)
• Proof of address documentation where required
• Source of funds declarations for accounts with high transaction volumes, as required by AMLC thresholds
• Selfie or live photograph for document verification matching, where applicable

2.3 Financial Transaction Data

ph997 processes and retains records of all financial transactions conducted through your account, including:

• Deposit amounts, timestamps, and payment method identifiers (GCash mobile number, PayMaya ID, bank account last digits)
• Withdrawal requests, amounts, and destination payment method identifiers
• Transaction reference numbers and payment processor records
• Wallet balance history

2.4 Gaming Activity Data

ph997 records comprehensive gaming activity data for operational, regulatory, and responsible gaming purposes:

• Games played, bet amounts, game outcomes, and session timestamps
• Bonus claims, wagering progress, and promotional participation history
• Game session duration and frequency patterns
• Responsible gaming tool usage (deposit limits set, cool-off periods requested)

2.5 Technical & Device Data

ph997 automatically collects technical information when you access the Platform:

• IP address and general geographic location derived therefrom
• Device type, operating system, and browser version
• Device fingerprint (for fraud prevention and duplicate account detection)
• Session logs including login times, page navigation, and session duration
• Cookie and tracking data (see Section 6)

2.6 Customer Support Communications

When you contact ph997's customer support team, we collect and retain records of those communications — including live chat transcripts, email correspondence, and support ticket contents — for quality assurance, dispute resolution, and regulatory compliance purposes.

ph997 uses collected personal data for the following documented purposes:

3.1 Marketing Communications

Where you have provided separate consent during registration or through your account settings, ph997 may send you promotional communications about new games, bonuses, and platform features via SMS to your registered Philippine mobile number and/or email. You may withdraw consent to marketing communications at any time through your account settings or by contacting ph997 support. Withdrawal of marketing consent does not affect the lawfulness of prior processing based on consent.

Under the Philippine Data Privacy Act, ph997 processes personal data under the following lawful bases:

1. Contractual Necessity: Processing required to fulfil the ph997 Player Agreement — account management, transaction processing, game access, and customer support services.
2. Legal Obligation: Processing mandated by applicable Philippine law, including PAGCOR licensing requirements, Republic Act No. 9160 (Anti-Money Laundering Act) as amended by RA 10927, and relevant AMLC circulars. ph997 has no discretion to refuse this processing.
3. Legitimate Interest: Processing necessary for ph997's legitimate business interests where those interests do not override your fundamental privacy rights — including fraud prevention, security monitoring, responsible gaming oversight, and platform analytics.
4. Consent: Processing for purposes where you have provided explicit, freely given, specific, and informed consent — principally, direct marketing communications. You may withdraw this consent at any time without detriment to your account status.

5.1 Regulatory Authorities

ph997 is required by law to share personal data and transaction records with regulatory and law enforcement bodies, including PAGCOR (as part of licensing compliance and investigations), the Anti-Money Laundering Council (AMLC) (for covered and suspicious transaction reporting under RA 9160), and any other competent Philippine governmental authority where legally compelled. These disclosures occur without prior notice to the data subject where legally prohibited from doing so.

5.2 Service Providers (Data Processors)

ph997 engages third-party service providers who process personal data on our behalf — as data processors acting under ph997's instructions. These include:

• Payment processors and e-wallet operators (GCash, PayMaya, bank partners) — for transaction processing
• KYC and identity verification technology providers — for document verification services
• Game content providers — limited technical data necessary for game delivery and RNG certification
• Cloud infrastructure and data hosting providers — under strict data processing agreements
• Customer support platform providers — for live chat and ticket management systems
• Fraud detection and security service providers

All third-party data processors engaged by ph997 are bound by written data processing agreements that require them to maintain data security standards consistent with ph997's obligations under Philippine law and to process personal data only as instructed by ph997.

5.3 No Sale of Personal Data

ph997 does not sell, rent, licence, or otherwise commercially transfer your personal data to any third party for that third party's independent marketing, profiling, or commercial purposes. This prohibition is absolute and applies regardless of the commercial value of the data.

6.1 What Are Cookies

Cookies are small text files stored on your device by your browser when you visit the ph997 Platform. ph997 uses cookies and similar tracking technologies (such as local storage objects and session tokens) to operate the Platform, maintain your logged-in session, prevent fraud, and analyse Platform usage patterns.

6.2 Types of Cookies Used by ph997

6.3 Managing Cookies

You can control and delete cookies through your browser settings. However, disabling strictly necessary cookies will impair your ability to log in to and use the ph997 Platform. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Firefox, Safari, Samsung Internet, etc.).

ph997 implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include but are not limited to:

• Encryption in transit: All data transmitted between your device and ph997's servers is encrypted using 256-bit SSL/TLS protocols. The padlock icon and HTTPS prefix in your browser's address bar confirm this encryption is active.
• Encryption at rest: Sensitive personal data stored in ph997's databases — including KYC documents, government ID information, and financial data — is encrypted at rest using AES-256 encryption.
• Password security: Account passwords are stored as salted cryptographic hashes. ph997 technical staff cannot retrieve or view your plaintext password.
• Role-based access controls: Access to personal data systems is restricted to personnel with a documented operational need. Access rights are regularly reviewed and revoked upon change of role or employment.
• Multi-factor authentication: Internal access to ph997's data systems requires multi-factor authentication for all personnel.
• Security monitoring: ph997 maintains continuous security monitoring systems to detect and respond to unauthorised access attempts, data exfiltration, and other security incidents.
• Regular security assessments: ph997 conducts periodic vulnerability assessments and security audits of its data processing infrastructure.

ph997 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to overriding legal and regulatory retention requirements. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted using methods that render recovery impractical, or anonymised such that the data can no longer be attributed to an identifiable individual. Anonymised data may be retained for statistical and analytical purposes without retention limits.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights as a data subject. ph997 is committed to facilitating the exercise of these rights in a clear, accessible, and timely manner:

ph997 primarily processes personal data within the Republic of the Philippines. In limited circumstances, the use of third-party service providers (such as game content providers or cloud infrastructure services) may involve the transfer or access of personal data outside the Philippines.

Where personal data is transferred outside the Philippines, ph997 ensures that appropriate safeguards are in place as required by the Data Privacy Act and NPC regulations — including:

• Data processing agreements containing standard contractual clauses requiring equivalent data protection standards
• Transfer to jurisdictions recognised by the NPC as providing adequate data protection
• Binding corporate rules where applicable within corporate groups

ph997 does not transfer personal data to countries that do not provide adequate data protection standards without appropriate safeguards in place. You may request details of the specific safeguards applied to any international transfer by contacting ph997's DPO.

The ph997 Platform is strictly prohibited for persons under the age of 21 years, in accordance with PAGCOR's minimum gambling age requirement for licensed online gaming operations in the Philippines. ph997 does not knowingly collect personal data from persons under the age of 21.

If ph997 becomes aware that personal data has been collected from a person under the age of 21 — whether through registration, age verification, or any other means — ph997 will immediately close the associated account, delete all personal data collected from that individual to the extent not required for legal reporting purposes, and take appropriate remedial action in accordance with PAGCOR requirements.

Parents and guardians who believe their child may have created a ph997 account or accessed the ph997 Platform are advised to contact ph997's customer support team immediately at [email protected]. ph997 will investigate and respond within 24 hours.

ph997 maintains documented incident response and data breach notification procedures in accordance with the National Privacy Commission's regulations on data breach notification (NPC Circular No. 16-03 and subsequent issuances).

12.1 Internal Incident Response

Upon discovery or credible suspicion of a personal data breach, ph997's Data Protection Officer is notified immediately. ph997 will conduct a documented assessment of the breach within 72 hours, including the scope of affected data, the likely consequences, and the measures taken or proposed to address the breach.

12.2 NPC Notification

Where a data breach is likely to give rise to a real risk of serious harm to affected data subjects, ph997 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, as required by NPC regulations. The notification will include all information required by the NPC's breach notification guidelines.

12.3 Data Subject Notification

Where a data breach is likely to adversely affect the rights and freedoms of affected ph997 Players, ph997 will notify affected data subjects without undue delay — typically by email to the registered address and/or SMS to the registered Philippine mobile number. The notification will describe the nature of the breach, the likely consequences, and the steps affected Players should take to protect themselves.

ph997 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. Material changes to this Policy — those that significantly affect how your personal data is processed or your rights as a data subject — will be communicated to active Players via in-account notification and/or email to your registered address at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Privacy Policy reflects the date of the most recent revision. We recommend that you review this Privacy Policy periodically to stay informed about how ph997 protects your personal information. Your continued use of the ph997 Platform following the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated terms.

For historical versions of this Privacy Policy, or to understand the specific changes made in the most recent update, please contact ph997's Data Protection Officer using the contact details in Section 14 below.

For any questions, concerns, or requests relating to this Privacy Policy or ph997's personal data processing practices, please contact ph997's Data Protection Officer: