phll Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected, processed, stored, and used by phll in connection with:

• The phll website accessible at phll.one and all associated subdomains and pages.
• The registration, verification, and management of phll player accounts.
• The provision of online gaming services including live casino, slots, sports betting, Sabong, Bingo, and Aviator.
• Payment processing, deposit, and withdrawal transactions conducted through phll.
• Customer support interactions conducted via live chat, email, or any other channel provided by phll.
• Marketing communications sent by phll to players who have consented to receive them.

This Policy applies to all registered phll players and to unregistered visitors who access the phll platform. By accessing or using phll in any capacity, you are subject to this Policy. If you are accessing phll on behalf of another person, you represent that you have the authority to bind that person to this Policy.

phll acts as the Personal Information Controller in respect of personal data collected through the phll platform. As Personal Information Controller, phll determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted in accordance with applicable Philippine data protection law.

For all data protection enquiries, requests to exercise your rights, or complaints relating to phll's handling of your personal data, you may contact the phll Data Protection Officer via the contact details provided in Section 14 of this Policy.

phll collects the following categories of personal data from registered players and platform visitors:

Identity & Registration Data

• Full legal name as it appears on your government-issued identification document.
• Date of birth and age verification information.
• Philippine residential address, including barangay, city or municipality, and province.
• Nationality and country of residence.
• Copies or images of Philippine government-issued identification documents submitted for identity verification (Passport, SSS/UMID, PhilHealth ID, Driver's License, Voter's ID, PRC ID, PhilSys National ID).
• Selfie photographs submitted alongside identification documents for liveness verification purposes.

Contact & Login Data

• Philippine mobile number registered to your account.
• Email address associated with your phll account.
• Account login credentials (password stored in hashed, non-reversible form — phll does not store plain-text passwords).

Financial & Payment Data

• GCash account number or registered GCash mobile number used for deposits and withdrawals.
• PayMaya account details used for payment transactions.
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) where bank transfers are used.
• Visa or Mastercard debit or credit card details (card number, expiry date) where cards are used for deposits — card data is processed through PCI-DSS compliant payment processors and is not stored in full on phll systems.
• Transaction history, including deposit amounts, dates, payment methods, and withdrawal records.

Gaming & Activity Data

• Game session history, including games played, bets placed, results, and win/loss records.
• Sports betting records, including events wagered on, bet types, amounts, and outcomes.
• Bonus and promotion participation records.
• Responsible gaming settings applied to your account, including deposit limits, self-exclusion periods, and session reminder configurations.

Technical & Device Data

• IP address at the time of login and during platform use.
• Device type, operating system, and browser type and version.
• Unique device identifiers where applicable.
• Geolocation data derived from IP address, used for regulatory compliance and fraud detection purposes.
• Session logs, including login timestamps, pages visited, and actions taken on the platform.

Communications Data

• Content of live chat conversations with phll support agents.
• Email correspondence sent to or received from phll's support address.
• Records of marketing communications sent to you, including open and click data where available.

phll collects personal data through the following means:

phll does not collect personal data from social media platforms or other third-party services unless you explicitly provide phll with access to such data. phll does not purchase personal data lists from third parties for marketing purposes.

phll processes personal data only for defined, specified, and legitimate purposes in accordance with Section 11 of the Philippine Data Privacy Act. The following table sets out the principal purposes for which phll processes personal data and the corresponding legal basis:

phll does not sell, rent, or trade personal data with third parties for their own commercial purposes. phll may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

Service Providers & Processors

• Identity Verification Providers: Third-party KYC and age verification services that process your identification documents and selfie photographs on phll's behalf to verify your identity and age.
• Payment Processors: GCash (Mynt), PayMaya (PayMongo/Voyager), BancNet, and card processing networks as necessary to facilitate deposit and withdrawal transactions. These providers receive only the payment data necessary to complete each transaction.
• Game Providers: Licensed game studios (Pragmatic Play, PG Soft, Evolution Gaming, Jili, and others) may receive session identifiers and bet-level data required for game operation and integrity purposes. Game providers do not receive your full personal profile.
• Technology & Infrastructure Providers: Cloud hosting, database, and platform infrastructure providers may process personal data as part of platform operations, subject to data processing agreements with phll.
• Customer Support Systems: Live chat and support ticketing platform providers may process communications data as part of support service delivery.

Regulatory & Law Enforcement Authorities

• Philippine gaming regulatory authorities, including PAGCOR, where disclosure is required for regulatory oversight, inspection, or compliance reporting.
• The Anti-Money Laundering Council (AMLC) and related authorities where transaction reporting obligations apply.
• Philippine law enforcement agencies where phll is subject to a valid legal order, court order, subpoena, or other lawful demand requiring disclosure.
• The National Privacy Commission (NPC) in response to valid regulatory requests or in the event of a reportable personal data breach.

phll uses cookies and similar tracking technologies on the phll platform. Cookies are small text files placed on your device by the phll website that enable the platform to recognise your browser and retain certain information across sessions.

Types of Cookies Used by phll

• Strictly Necessary Cookies: Required for the phll platform to function. These include session authentication cookies that keep you logged in to your phll account, security tokens, and load balancing cookies. These cannot be disabled without impairing platform function.
• Functional Cookies: Remember your platform preferences such as language settings, game lobby filters, and responsible gaming limit displays. These enhance your experience without being required for core platform operation.
• Analytics Cookies: Collect aggregated, anonymised data about how visitors use the phll platform — pages visited, session duration, navigation paths — to help phll understand platform performance and improve the user experience. Analytics data is not used to identify individual players.
• Security & Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, including account takeover attempts, bot activity, and suspicious betting patterns.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, disabling strictly necessary cookies will impair your ability to use the phll platform, including logging in to your account. phll does not use cookies to serve third-party advertising on the platform.

phll implements a range of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between player devices and phll servers.
• Encryption of personal data at rest using industry-standard encryption protocols.
• Hashing of account passwords using bcrypt or equivalent secure hashing algorithms — phll does not store or have access to plain-text passwords.
• Multi-factor authentication options for player accounts and mandatory two-factor authentication for phll administrative access.
• Access controls limiting phll staff access to personal data on a strict need-to-know basis, with role-based permissions and audit logging of data access events.
• Regular security assessments and penetration testing of phll platform infrastructure.
• Automated anomaly detection and alerting systems monitoring for suspicious login activity, data access patterns, and transaction irregularities.

While phll applies industry-standard security measures, no system is completely immune to security threats. Players are responsible for maintaining the confidentiality of their own login credentials and for using secure, private devices when accessing the phll platform. phll encourages all Filipino players to enable two-factor authentication on their phll account and to use strong, unique passwords.

phll retains personal data for the minimum period necessary to fulfill the purposes for which it was collected or as required by applicable law. The following general retention schedules apply:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Where anonymisation is not technically feasible, data is securely destroyed in accordance with phll's data disposal procedures.

Under the Philippine Data Privacy Act of 2012, registered phll players have the following rights with respect to their personal data:

phll may send you marketing communications — including promotional offers, bonus notifications, event announcements, and platform updates — by SMS to your registered Philippine mobile number and by email to your registered email address, where you have consented to receive such communications.

Marketing communications are opt-in. You may withdraw your consent to receive marketing from phll at any time by:

• Updating your communication preferences in your phll account settings panel.
• Clicking the unsubscribe link included in any phll marketing email.
• Contacting phll support via live chat and requesting removal from marketing communications.

Withdrawal of marketing consent does not affect your ability to receive transactional communications from phll — such as deposit confirmations, withdrawal notifications, account security alerts, and support responses — which are sent as part of phll's contractual obligations to you regardless of marketing preferences.

phll does not share your personal data with third parties for their own direct marketing purposes, and phll's marketing communications are sent only by phll. If you receive communications purportedly from phll that you did not consent to, please contact phll support immediately as this may indicate a phishing or impersonation attempt.

If phll becomes aware that personal data has been collected from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. If you are a parent or guardian and believe that a person under 21 in your care has registered on phll or provided personal data to phll, please contact our support team immediately via live chat so that the matter can be investigated and resolved promptly.

phll's mandatory identity verification process, which requires submission of a valid Philippine government-issued ID, is the primary mechanism for enforcing the 21+ age requirement and preventing collection of data from underage individuals. phll takes this obligation seriously and applies heightened scrutiny to any account where age verification raises concerns.

phll reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, phll's data processing practices, or platform functionality. The "Last Updated" date at the top of this document indicates when the most recent revision was published.

Where amendments are material — meaning they significantly affect how phll processes your personal data or your rights under this Policy — phll will notify registered players via their registered email address prior to the changes taking effect, providing a reasonable period to review the revised Policy. For minor or non-material amendments, notification will be provided via a prominent notice on the phll platform.

Your continued use of the phll platform following the effective date of any amendment to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised terms, please close your phll account and contact support to request erasure of your personal data to the extent permissible under applicable law.

For all privacy-related enquiries, requests to exercise your rights under the Philippine Data Privacy Act, or complaints relating to phll's handling of your personal data, please contact phll through the following channels:

• Live Chat: Available 24/7 through the phll platform. The fastest channel for all account and data enquiries, including right-to-access requests and marketing opt-out requests.
• Email: [email protected] — for formal privacy requests, data erasure applications, complaints, and any correspondence with phll's Data Protection Officer. Please mark privacy-related emails with "Privacy Request" or "DPO" in the subject line for prompt routing.

phll will acknowledge all privacy-related requests within five (5) Philippine business days and will respond substantively within thirty (30) days or as required by applicable law.

If you are not satisfied with phll's response to your privacy complaint or believe that phll is not processing your personal data in accordance with the Philippine Data Privacy Act, you have the right to lodge a formal complaint with the National Privacy Commission (NPC). The NPC is the Philippine government body responsible for administering the Data Privacy Act and may be contacted through its official government channels.