ph626 Privacy Policy —
Your Data, Your Rights

1 Introduction

ph626 ("we," "us," or "ph626") operates the online gaming platform accessible at ph626.org. We act as the data controller for all personal information collected through this platform. This Privacy Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA"), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission of the Philippines.

This Privacy Policy applies to all personal data we collect from users ("you," "data subject") who register, access, or use the ph626 platform in any capacity — including browsing the website, registering an account, making deposits or withdrawals, placing bets, contacting customer support, or receiving promotional communications.

By creating a ph626 account or using the platform, you acknowledge that you have read this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent, you must not use the ph626 platform.

2 Personal Data We Collect

ph626 collects the following categories of personal data:

Data Category	Specific Data Points	Purpose
Identity Data	Full legal name, date of birth, nationality, government-issued ID number and copy	KYC verification, age verification, AMLA compliance
Contact Data	Philippine mobile number, email address	Account communication, OTP delivery, support
Address Data	Home address, city, province, postal code	KYC verification, PAGCOR compliance
Financial Data	GCash number, bank account details (last 4 digits), transaction amounts, deposit and withdrawal records	Payment processing, AML monitoring, tax reporting
Account Data	Login credentials (hashed), account balance, bonus history, session logs	Account management, security, responsible gaming
Gaming Activity	Games played, bet amounts, win/loss history, game session duration	Responsible gaming monitoring, dispute resolution, PAGCOR reporting
Technical Data	IP address, device type, operating system, browser type, geolocation data	Fraud prevention, security, platform optimization
Communications Data	Live chat transcripts, support tickets, email correspondence	Customer support, quality assurance, dispute resolution

3 How We Collect Your Data

ph626 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or filling in any form on the ph626 platform.
• Automated collection: Technical data collected automatically when you access the ph626 website or app, including IP address, device identifiers, browser type, operating system, session duration, and page interactions via cookies and similar technologies.
• Third-party sources: Identity verification data from KYC service providers; transaction data from GCash, Maya, BPI, BDO, and other payment processors; fraud prevention data from security service providers; and publicly available data where relevant to account security.

4 Legal Basis for Processing

ph626 processes your personal data on the following legal bases as provided under RA 10173:

• Consent: For marketing communications and optional features where you have provided explicit consent at registration or subsequently.
• Contractual necessity: Processing required to fulfill our obligations under the ph626 Terms & Conditions, including operating your account, processing payments, and delivering gaming services.
• Legal obligation: Processing required to comply with Philippine law, including the Anti-Money Laundering Act (RA 9160 as amended), PAGCOR licensing conditions, and the National Privacy Commission's applicable issuances.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and product improvement — where such interests do not override your fundamental rights and freedoms.

5 How We Use Your Personal Data

ph626 uses the personal data we collect for the following purposes:

• To register and manage your ph626 account;
• To process deposits, withdrawals, and all financial transactions through GCash, Maya, BPI, BDO, GrabPay, and other supported payment methods;
• To verify your identity and age in compliance with PAGCOR licensing requirements and the Philippine Data Privacy Act;
• To monitor transactions for suspicious activity in compliance with the Anti-Money Laundering Act;
• To deliver customer support via live chat, email, and other communication channels;
• To monitor gaming activity for responsible gaming purposes, including identifying signs of problem gambling;
• To detect and prevent fraud, unauthorized access, and other security threats;
• To improve the ph626 platform through analytics, testing, and user research;
• To send service notifications, security alerts, and — where you have consented — promotional communications;
• To comply with reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), and other relevant Philippine regulatory bodies.

6 Data Sharing and Disclosure

ph626 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the following circumstances and with the following categories of recipients:

6.1 Payment Processors

ph626 shares the minimum necessary financial data with GCash, Maya, GrabPay, BPI, BDO, Metrobank, and InstaPay to process your deposits and withdrawals. These processors operate under their own privacy frameworks and are subject to Philippine financial privacy regulations.

6.2 Game Providers

ph626 shares a pseudonymized player identifier with licensed game providers (including Evolution Gaming, Pragmatic Play, PG Soft, and others) to enable game play and resolve game-related disputes. These providers do not receive your full identity data.

6.3 Identity Verification Services

ph626 uses third-party KYC service providers to verify government-issued identification documents. These providers process identity data under strict confidentiality agreements and in compliance with RA 10173.

6.4 Regulatory Authorities

ph626 discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government authorities when required by law, court order, or binding regulatory directive.

6.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of ph626's assets, personal data held by ph626 may be transferred to the acquiring entity. You will be notified via your registered email address before any such transfer occurs, and your rights under RA 10173 will be preserved.

7 Cookies and Tracking Technologies

ph626 uses cookies and similar tracking technologies to operate the platform, maintain your session, prevent fraud, and analyze usage patterns. The following types of cookies are in use:

• Strictly necessary cookies: Required for the platform to function. These include session cookies that maintain your logged-in state and security tokens. These cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your preferences such as language settings and game history display preferences.
• Analytics cookies: Collect anonymized data about how users navigate the ph626 platform to help us identify improvements. Data collected through analytics cookies is aggregated and not linked to individual identities.
• Security cookies: Used for fraud detection and prevention, including identifying unusual login patterns and cross-device access.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing authenticated areas of the ph626 platform.

8 Data Security Measures

ph626 implements the following technical and organizational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data in transit between your device and ph626 servers;
• Encryption at rest for sensitive data including identity documents and financial records;
• Access controls ensuring that only authorized ph626 personnel can access personal data, with access limited to what is necessary for their job function;
• Pseudonymization of player data shared with game providers;
• Regular penetration testing and security audits conducted by independent security firms;
• Incident response procedures enabling ph626 to detect, contain, and notify affected users and the National Privacy Commission within 72 hours of a data breach, as required by RA 10173.

9 Data Retention

ph626 retains your personal data for the following periods:

• Active account data: Retained for the duration of your account's active status plus a minimum of five (5) years after account closure, in accordance with PAGCOR licensing requirements and AMLA retention obligations.
• Transaction records: Retained for a minimum of ten (10) years in compliance with the Anti-Money Laundering Act (RA 9160 as amended by RA 11521).
• KYC documents: Retained for the period required by PAGCOR and the AMLC — typically a minimum of five (5) years after the end of the customer relationship.
• Support communications: Retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until you withdraw your consent and for one (1) year thereafter as a record of the consent withdrawal.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents reconstruction of the individual's identity.

10 Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by ph626:

• Right to be informed: The right to be notified of the purposes, legal basis, and scope of personal data processing — which this Privacy Policy fulfills.
• Right of access: The right to obtain a copy of the personal data ph626 holds about you and information about how it is processed.
• Right to rectification: The right to correct inaccurate, incomplete, or outdated personal data in your ph626 account.
• Right to erasure or blocking: The right to request deletion or blocking of your personal data where processing is no longer necessary for the stated purpose — subject to ph626's legal retention obligations under AMLA and PAGCOR regulations.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used format for transfer to another controller where technically feasible.
• Right to object: The right to object to the processing of your personal data for direct marketing or on grounds relating to your particular situation where processing is based on legitimate interests.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of the above rights, contact ph626's Data Privacy Officer at [email protected]. ph626 will respond to all verified data subject requests within thirty (30) days of receipt, as required by RA 10173.

11 Marketing Communications

ph626 sends promotional emails, SMS notifications, and in-platform messages to users who have opted in to receive marketing communications. Your consent to receive marketing messages is obtained at registration and can be withdrawn at any time.

To unsubscribe from ph626 marketing communications:

• Click the "Unsubscribe" link in any marketing email;
• Reply "STOP" to any promotional SMS from ph626;
• Update your communication preferences in your ph626 account settings; or
• Contact ph626 support at [email protected] to request removal from all marketing communications.

Withdrawal of marketing consent does not affect the lawfulness of marketing communications sent prior to your withdrawal, and does not affect ph626's ability to send you service notifications, security alerts, or legally required communications related to your account.

12 Children's Privacy

If you believe that a minor's personal data has been submitted to ph626, please contact us immediately at [email protected] and we will take immediate remedial action.

13 Cross-Border Data Transfers

In certain circumstances, ph626 may transfer your personal data outside the Philippines — for example, to game providers or technology infrastructure providers that operate servers in other countries. Such transfers are conducted in compliance with the Data Privacy Act of 2012 and applicable NPC guidelines on cross-border data transfers.

Before transferring personal data outside the Philippines, ph626 ensures that:

• The recipient country or organization provides an adequate level of data protection; or
• Appropriate safeguards are in place, such as contractual data processing agreements that impose obligations equivalent to those under RA 10173; or
• You have provided explicit consent to the cross-border transfer; or
• The transfer is required for the performance of a contract between you and ph626 (such as processing a GCash payment facilitated through an international payment network).

14 Third-Party Links

The ph626 platform may contain references to third-party services, including game providers and payment processors. Once you leave the ph626 platform and access a third-party service, this Privacy Policy no longer applies. ph626 is not responsible for the privacy practices of third-party services. We recommend reviewing the privacy policy of any third-party service you interact with.

15 Changes to This Privacy Policy

ph626 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or NPC guidance. Where material changes are made to this Policy, ph626 will notify registered users via their registered email address at least seven (7) days before the changes take effect.

The effective date displayed at the top of this document reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed of how ph626 protects your personal data. Your continued use of the ph626 platform after the effective date of any revision constitutes acceptance of the updated Policy.

16 Contact and Data Privacy Officer

If you have questions, concerns, or requests relating to this Privacy Policy or ph626's personal data processing practices, please contact ph626's designated Data Privacy Officer:

• Email: [email protected]
• Platform: ph626.org (live chat support, available 24/7)
• Response time: ph626 will acknowledge your privacy-related request within 48 hours and provide a full response within 30 days, as required by RA 10173.

If you are not satisfied with ph626's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.