Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how phthaya ("phthaya," "we," "us," or "our") collects, uses, stores, and protects the personal information of users ("you," "Player," or "User") who access or use the phthaya website and online gaming platform (collectively, the "Platform"). phthaya is committed to safeguarding your privacy and handling your personal data with transparency, integrity, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations.

By registering an account on phthaya or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform and contact us to close your account.

This Policy should be read together with phthaya's Terms and Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Personal Data We Collect

2.1 Registration & Identity Data

When you create a phthaya account, we collect information necessary to establish and verify your identity, including:

• Full legal name as it appears on your government-issued ID
• Date of birth (to verify you are at least 21 years of age)
• Nationality and country of residence
• Email address and mobile phone number
• Username and encrypted password
• Residential address

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) regulations and PAGCOR requirements, phthaya may request copies of:

• Government-issued photo identification (Philippine passport, SSS ID, UMID, driver's license, or PhilSys national ID)
• Proof of address (utility bill, bank statement, or barangay certificate dated within the last three months)
• Proof of payment method ownership (screenshot of GCash or PayMaya account, or bank statement)
• Source of funds documentation where required by applicable regulations

2.3 Financial & Transaction Data

phthaya collects records of all financial transactions conducted through your account, including deposit amounts, withdrawal requests, payment method details (masked card numbers, GCash or PayMaya account references), transaction timestamps, and currency amounts in Philippine Peso (PHP).

2.4 Gaming Activity Data

We collect data about your gaming activity on the phthaya Platform, including games played, bet amounts, win/loss records, session durations, and responsible gaming tool usage (such as deposit limits or self-exclusion requests).

2.5 Technical & Device Data

When you access phthaya, we automatically collect certain technical information, including your IP address, device type and operating system, browser type and version, referring URL, pages visited, and session timestamps. This data is used for security monitoring, fraud prevention, and platform optimization.

2.6 Communications Data

If you contact phthaya's customer support team, we retain records of your communications, including chat transcripts, email correspondence, and support ticket history, to ensure quality service and resolve disputes.

3. How We Collect Your Data

phthaya collects personal data through the following means:

• Direct collection: Information you provide when registering, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical and device data collected automatically through cookies, web beacons, log files, and similar tracking technologies when you use the Platform.
• Third-party sources: Identity verification data from KYC service providers, fraud prevention data from security partners, and payment data from payment processors such as GCash, PayMaya, BPI, BDO, and Metrobank.

4. How We Use Your Personal Data

phthaya uses your personal data for the following purposes:

• To create, manage, and maintain your phthaya account.
• To verify your identity and age (21+) in compliance with applicable regulations.
• To process deposits, withdrawals, and other financial transactions in PHP.
• To detect, investigate, and prevent fraud, money laundering, and other prohibited activities.
• To provide customer support and resolve disputes.
• To personalize your experience on the phthaya Platform.
• To send you transactional communications (account confirmations, withdrawal notifications, security alerts).
• To send you promotional communications, where you have opted in to receive them.
• To comply with legal and regulatory obligations, including reporting requirements under Philippine AML laws.
• To monitor and improve the performance, security, and functionality of the Platform.
• To enforce phthaya's Terms and Conditions and other platform policies.

5. Legal Basis for Processing

phthaya processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given explicit consent, such as for marketing communications or optional data collection.
• Contractual necessity: Processing required to fulfill our obligations under the Terms and Conditions you agreed to upon registration.
• Legal obligation: Processing required to comply with applicable Philippine laws, including AML regulations, PAGCOR requirements, and tax reporting obligations.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and improving our services, where such interests are not overridden by your data protection rights.

6. Data Sharing & Disclosure

phthaya does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with the following categories of recipients only as necessary and on a need-to-know basis:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard, to process your financial transactions.
• KYC and identity verification providers: Third-party services that assist phthaya in verifying player identities and complying with AML regulations.
• Game providers: Software providers whose games are available on the phthaya Platform, to the extent necessary to deliver game services.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where required by law.
• Law enforcement: Philippine law enforcement agencies, where required by a valid court order, subpoena, or legal process.
• Service providers: IT infrastructure, cloud hosting, customer support, and analytics providers who process data on phthaya's behalf under strict data processing agreements.

All third parties with whom phthaya shares personal data are required to maintain appropriate security measures and to use the data only for the specified purpose.

7. Data Retention

phthaya retains your personal data for as long as your account is active and for a period thereafter as required by applicable law. Specifically:

• Account and identity data is retained for a minimum of five (5) years following account closure, in compliance with Philippine AML record-keeping requirements.
• Transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Customer support communications are retained for three (3) years from the date of the interaction.
• Technical and device data collected through cookies and logs is retained for up to twelve (12) months.

After the applicable retention period, phthaya will securely delete or anonymize your personal data in accordance with its data disposal procedures.

8. Data Security

phthaya implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the phthaya Platform.
• Encryption of sensitive data at rest, including passwords (stored as salted hashes) and financial information.
• Access controls limiting employee access to personal data on a strict need-to-know basis.
• Regular security audits, vulnerability assessments, and penetration testing.
• 24/7 monitoring of platform infrastructure for suspicious activity.
• Incident response procedures to detect, contain, and notify affected parties of any data breach in accordance with NPC requirements.

While phthaya takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phthaya login credentials and for notifying us immediately if you suspect unauthorized access to your account.

9. Cookies & Tracking Technologies

phthaya uses cookies and similar tracking technologies to enhance your experience on the Platform. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and analyze how the Platform is used.

Types of cookies we use:

• Essential cookies: Required for the Platform to function correctly, including session management and security features. These cannot be disabled.
• Performance cookies: Collect anonymized data about how players use the Platform to help us improve performance and user experience.
• Functional cookies: Remember your preferences, such as language settings and display options.
• Analytics cookies: Help phthaya understand aggregate usage patterns to improve the Platform.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the phthaya Platform.

10. Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phthaya:

• Right to be informed: The right to know what personal data phthaya collects and how it is used — which this Policy fulfills.
• Right of access: The right to request a copy of the personal data phthaya holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to phthaya's legal retention obligations.
• Right to object: The right to object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to data portability: The right to receive your personal data in a structured, commonly used format.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe phthaya has violated your data privacy rights.

To exercise any of these rights, please contact phthaya's Data Protection Officer at [email protected]. We will respond to all verified requests within fifteen (15) business days in accordance with NPC guidelines.

11. Children's Privacy

The phthaya Platform is strictly intended for adults aged 21 years and older. phthaya does not knowingly collect personal data from individuals under the age of 21. If we become aware that a person under 21 has registered an account or provided personal data, we will immediately suspend the account, delete the associated data, and void any transactions. If you believe a minor has accessed the phthaya Platform, please contact us immediately at [email protected].

12. International Data Transfers

phthaya primarily stores and processes your personal data within the Philippines. In certain circumstances, your data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or international game software vendors. Where such transfers occur, phthaya ensures that appropriate safeguards are in place, including contractual data processing agreements that require the recipient to maintain data protection standards equivalent to those required under Philippine law. By using the phthaya Platform, you consent to such transfers where necessary for the provision of our services.

13. Third-Party Links

The phthaya Platform may contain links to third-party websites or services for informational purposes. phthaya is not responsible for the privacy practices or content of any third-party websites. We encourage you to review the privacy policies of any third-party sites you visit. This Policy applies solely to data collected by phthaya through the phthaya Platform.

14. Updates to This Policy

phthaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect. The "Last updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the phthaya Platform after any update constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or phthaya's data handling practices, please contact our Data Protection Officer:

Email: [email protected]

phthaya aims to respond to all privacy-related inquiries within fifteen (15) business days. If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.