1. About This Policy
This Privacy Policy ("Policy") is published by phpak ("phpak," "we," "us," or "our"), the operator of the online gaming platform at phpak.org ("Platform"). It describes how phpak collects, processes, stores, and discloses personal data in connection with your use of the Platform and any related services.
phpak operates under the regulatory authority of the Philippine Amusement and Gaming Corporation (PAGCOR) and complies with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA") of the Philippines, its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission ("NPC"). By registering for and using phpak, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.
Data Controller: phpak is the personal information controller responsible for your personal data collected through phpak.org. Queries regarding this Policy may be directed to support@phpak.org.
2. Information We Collect
phpak collects personal data in the following categories, depending on how you interact with the Platform:
2.1 Registration & Identity Data
- Full legal name as it appears on your government-issued ID
- Date of birth (for mandatory age verification — players must be 21 or older)
- Email address and mobile number
- Residential address (city, province, country)
- Username and encrypted password
- Copies of government-issued identification documents (e.g., Philippine passport, SSS ID, UMID, PhilSys ID, driver's licence) submitted during KYC verification
2.2 Financial Data
- GCash account number or PayMaya account linked to your phpak account
- BPI, BDO, or Metrobank account details submitted for deposit or withdrawal purposes
- Transaction history: deposits, withdrawals, bet amounts, and game outcomes
- Source-of-funds documentation requested under AML compliance obligations
2.3 Usage & Technical Data
- IP address and approximate geolocation at time of login
- Device type, operating system, and browser information
- Session duration, pages visited, and game activity logs
- Login timestamps and session identifiers
2.4 Communications Data
- Records of live chat conversations with phpak support agents
- Email correspondence sent to or received from phpak
- Feedback, complaints, and dispute records
2.5 Responsible Gaming Data
- Deposit limits and session time limits set by you
- Self-exclusion requests and exclusion period records
- Reality check acknowledgements and responsible gaming tool usage logs
3. How We Use Your Information
phpak processes your personal data for the following purposes:
- Account Management: Creating, maintaining, and securing your phpak account; verifying your identity and age; processing phpak login authentication.
- Service Delivery: Providing access to games, processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank; crediting bonuses and promotions to your account.
- Regulatory Compliance: Fulfilling phpak's obligations under PAGCOR licensing conditions, the Data Privacy Act of 2012, and Philippine anti-money laundering laws (Republic Act No. 9160, as amended). This includes identity verification, transaction monitoring, and mandatory reporting to regulatory authorities.
- Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, multiple account creation, bonus abuse, money laundering, and other prohibited conduct on phpak.
- Customer Support: Responding to your inquiries, resolving disputes, and providing technical assistance via live chat and email.
- Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behaviour; administering self-exclusion requests and deposit limit configurations.
- Platform Improvement: Analysing aggregate, anonymised usage data to improve the phpak Platform, game selection, and user experience.
- Marketing Communications: Sending you promotional communications about phpak offers and game launches, where you have provided consent. You may withdraw consent at any time by contacting phpak support.
4. Legal Basis for Processing
phpak processes your personal data on the following legal bases under the Data Privacy Act of 2012:
- Contractual necessity: Processing required to perform our contract with you (your phpak account agreement and these Terms).
- Legal obligation: Processing required to comply with PAGCOR licensing requirements, Philippine AML laws, tax obligations, and NPC directives.
- Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights.
- Consent: Processing for direct marketing communications, where you have provided explicit consent. Consent may be withdrawn at any time.
5. Sharing Your Information
phpak does not sell your personal data to third parties. We may share your personal data in the following limited circumstances:
- Payment Processors: GCash (G-Xchange, Inc.), PayMaya (Voyager Innovations, Inc.), and partner banks (BPI, BDO, Metrobank) — to process deposits and withdrawals. These parties are contractually bound to handle your data in accordance with applicable Philippine data protection law.
- Game Software Providers: Accredited studios (e.g., JILI, Pragmatic Play, PG Soft, Evolution Gaming) receive session tokens and bet data necessary to operate games. They do not receive your full identity or financial data.
- Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies — where disclosure is required by law, court order, or regulatory directive.
- IT Service Providers: Cloud hosting, cybersecurity, and analytics providers operating under strict data processing agreements that prohibit independent use of your data.
- Corporate Transactions: In the event of a merger, acquisition, or sale of phpak assets, your data may be transferred as part of that transaction, subject to the same privacy protections described in this Policy.
6. Cookies & Tracking Technologies
phpak uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are used:
- Strictly Necessary Cookies: Required for phpak login session management, security, and basic Platform functionality. These cannot be disabled without preventing Platform access.
- Functional Cookies: Remember your preferences such as language settings and game lobby view configurations.
- Analytics Cookies: Aggregate, anonymised data on how players navigate phpak, used to improve Platform design and performance. No individual player is identified in analytics reports.
You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent phpak login and Platform access.
7. Data Retention
phpak retains your personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods mandated by Philippine law:
- Identity & KYC Records: Minimum five (5) years from account closure, as required by PAGCOR and AMLC regulations.
- Financial Transaction Records: Minimum five (5) years, in compliance with anti-money laundering requirements.
- Responsible Gaming Records: Duration of any self-exclusion period plus two (2) years following expiry.
- Support & Communications Records: Three (3) years from the date of the last interaction.
Upon expiry of the applicable retention period, phpak will securely delete or anonymise your personal data.
8. Data Security
phpak implements technical and organisational security measures appropriate to the nature of the personal data processed, including:
- 256-bit SSL/TLS encryption for all data transmitted between your device and phpak servers
- Encrypted storage of passwords using industry-standard hashing algorithms (passwords are never stored in plaintext)
- Two-factor authentication (OTP) available for all phpak accounts
- Regular penetration testing and security audits by qualified third-party assessors
- Role-based access controls limiting phpak staff access to personal data to those with a documented business need
- Incident response procedures compliant with NPC breach notification requirements
In the event of a personal data breach affecting your phpak account, phpak will notify you and the National Privacy Commission in accordance with the timelines and procedures prescribed by the Data Privacy Act of 2012 and NPC Circular 16-03.
9. Your Rights
Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phpak:
- Right to be Informed: The right to know that phpak is collecting and processing your personal data, and the purposes for which it is processed — as documented in this Policy.
- Right to Access: The right to request a copy of the personal data phpak holds about you.
- Right to Rectification: The right to request correction of inaccurate or incomplete personal data in your phpak account.
- Right to Erasure: The right to request deletion of your personal data, subject to phpak's legal retention obligations under PAGCOR and AMLC regulations.
- Right to Object: The right to object to processing of your personal data for direct marketing purposes. Withdrawal of consent for marketing will not affect your phpak account access.
- Right to Data Portability: The right to receive a structured, machine-readable copy of personal data you have provided to phpak.
- Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph if you believe phpak has violated your data privacy rights.
To exercise any of the above rights, contact phpak's Data Protection Officer at support@phpak.org. phpak will respond to verified requests within fifteen (15) business days.
10. Children & Minors
phpak is strictly for persons aged twenty-one (21) years and above. 🔞 phpak does not knowingly collect personal data from individuals under the age of 21. If phpak discovers that a minor has created an account, the account will be immediately suspended, all data will be deleted, and deposits will be returned in accordance with phpak's underage gambling policy. If you believe a minor has accessed phpak, please contact us immediately at support@phpak.org.
11. Changes to This Policy
phpak may update this Privacy Policy from time to time to reflect changes in our data practices, applicable Philippine law, or PAGCOR regulatory requirements. Material changes will be communicated to registered players via email or Platform notification at least fourteen (14) days before taking effect. The updated Policy will be posted on this page with a revised effective date. Your continued use of phpak after the effective date of any update constitutes acceptance of the revised Policy.
12. Contact Us
For any privacy-related questions, data subject rights requests, or complaints regarding phpak's handling of your personal data, please contact:
- Data Protection Officer — phpak
- Email: support@phpak.org
- Live Chat: Available 24/7 on the phpak Platform
- Response Time: Within 15 business days for formal data subject requests; within 2 hours for general support enquiries
- Language: English and Filipino
For regulatory escalation, the National Privacy Commission of the Philippines may be contacted at privacy.gov.ph.