phtaa Privacy Policy

1. Introduction

phtaa ("phtaa," "we," "us," or "our") operates the online gaming platform accessible at https://phtaa.app and any associated mobile interfaces or applications (collectively, the "Platform"). We are committed to protecting the privacy and personal data of every individual who uses the phtaa Platform, whether as a registered account holder or as a visitor browsing our site.

This Privacy Policy ("Policy") describes the types of personal information we collect, the purposes for which we use it, the circumstances under which we may share it, and the rights you have in relation to your personal data. This Policy applies to all users of the phtaa Platform located in the Philippines and is drafted in compliance with Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations ("IRR"), as enforced by the National Privacy Commission ("NPC").

By registering an account on phtaa or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue use of the Platform immediately.

2. Personal Data We Collect

phtaa collects personal data through several channels — directly from you when you register or use the Platform, automatically through your device and browser, and occasionally from third-party sources such as payment processors and identity verification providers. The categories of personal data we collect include:

2.1 Registration and Identity Data

• Full legal name as it appears on your government-issued ID
• Date of birth (used to verify the 21+ age requirement)
• Philippine mobile number and email address
• Username and encrypted password
• Residential address (province, city/municipality, barangay)
• Government-issued ID type and number (e.g., PhilSys National ID, passport, driver's license, SSS/GSIS ID, PRC ID, voter's ID) — collected during KYC verification

2.2 Financial and Transaction Data

• GCash or PayMaya mobile number linked to your account
• Bank account details (bank name, account number) for withdrawal processing via BPI, BDO, Metrobank, UnionBank, Landbank, PNB, or Security Bank
• Debit card details (card number masked, expiry date) where applicable
• Deposit and withdrawal history, transaction amounts in Philippine Peso (₱), and timestamps
• Bonus and promotional activity records

2.3 Gaming Activity Data

• Game session logs, bet history, win/loss records, and wagering patterns
• Responsible gaming settings (deposit limits, session reminders, self-exclusion status)
• Customer support interactions and dispute records

2.4 Technical and Device Data

• IP address and approximate geolocation (used to verify Philippine jurisdiction)
• Device type, operating system, browser type and version
• Session duration, pages visited, and clickstream data
• Cookie identifiers and similar tracking technologies (see Section 6)

2.5 Communications Data

• Messages sent to phtaa customer support via live chat or email
• Survey responses and feedback submitted through the Platform
• Marketing preferences and communication opt-in/opt-out records

3. How We Use Your Personal Data

phtaa uses the personal data we collect for the following purposes:

Purpose	Data Used
Account registration and identity verification (KYC)	Identity data, government ID, date of birth
Processing deposits and withdrawals	Financial data, transaction history
Providing and improving gaming services	Gaming activity data, technical data
Fraud prevention and anti-money laundering (AML) compliance	Identity data, financial data, IP address
Responsible gaming monitoring and intervention	Gaming activity data, responsible gaming settings
Customer support and dispute resolution	Communications data, account data
Sending transactional notifications (deposits, withdrawals, security alerts)	Contact data, transaction data
Sending promotional communications (with your consent)	Contact data, marketing preferences
Regulatory reporting and legal compliance	Identity data, financial data, gaming activity
Platform analytics and performance optimization	Technical data, session data

phtaa will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by Philippine law.

4. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phtaa processes your personal data on the following legal bases:

• Consent: Where you have given us clear, informed, and freely given consent to process your data for a specific purpose — such as receiving marketing communications or promotional offers.
• Contractual Necessity: Where processing is necessary to perform our obligations under the phtaa Terms and Conditions — including account registration, payment processing, and game provision.
• Legal Obligation: Where processing is required to comply with applicable Philippine law, including anti-money laundering regulations, PAGCOR reporting requirements, and the Data Privacy Act itself.
• Legitimate Interests: Where processing is necessary for phtaa's legitimate business interests — such as fraud prevention, platform security, and responsible gaming monitoring — provided those interests are not overridden by your rights and freedoms.

5. Data Sharing and Disclosure

phtaa does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

5.1 Payment Processors

We share financial data with our payment processing partners — including GCash, PayMaya/Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) — solely to process your deposits and withdrawals. These partners are bound by their own privacy policies and applicable Philippine financial regulations.

5.2 Identity Verification Providers

We may share identity data with third-party KYC and identity verification service providers to verify your age and identity as required by Philippine gaming regulations. These providers process your data only for verification purposes and are contractually prohibited from using it for any other purpose.

5.3 Regulatory and Law Enforcement Authorities

phtaa may disclose your personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Philippine National Police, or other competent Philippine government authorities where required by law, court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.

5.4 Technology and Infrastructure Providers

We use third-party cloud hosting, analytics, and security service providers to operate the phtaa Platform. These providers process personal data on our behalf as data processors and are bound by data processing agreements that require them to protect your data in accordance with the DPA.

5.5 Corporate Transactions

In the event of a merger, acquisition, or sale of all or substantially all of phtaa's assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. We will notify you of any such transfer via the contact details on your account.

6. Cookies and Tracking Technologies

phtaa uses cookies and similar tracking technologies to enhance your experience on the Platform, maintain your session, and analyze usage patterns. The types of cookies we use include:

• Essential Cookies: Required for the Platform to function correctly — including session management, login authentication, and security features. These cannot be disabled without affecting Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymized data about how users interact with the phtaa Platform — such as pages visited, session duration, and navigation paths. This data helps us improve the Platform experience.
• Preference Cookies: Used to remember your settings and preferences — such as language selection and responsible gaming configurations — so you don't have to re-enter them each visit.
• Marketing Cookies: Used to deliver relevant promotional content based on your gaming activity and preferences, where you have consented to receive marketing communications.

You can manage your cookie preferences through your browser settings. Note that disabling essential cookies may impair your ability to use certain features of the phtaa Platform. For more information on managing cookies in popular Philippine mobile browsers, refer to your device's browser help documentation.

7. Data Retention

phtaa retains your personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable Philippine law. Our general retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with Philippine AML regulations.
• Financial and transaction data: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act of 2001 (as amended).
• Gaming activity data: Retained for three (3) years from the date of the activity, or longer if required for dispute resolution or regulatory purposes.
• Communications data: Retained for two (2) years from the date of the communication, or longer if relevant to an ongoing dispute or investigation.
• Technical and device data: Retained for twelve (12) months from collection, after which it is anonymized or deleted.

When personal data is no longer required for any lawful purpose, phtaa will securely delete or anonymize it in accordance with our data disposal procedures.

8. Data Security

phtaa implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phtaa Platform
• Encryption of sensitive data at rest, including financial data and government ID information
• Multi-factor authentication (MFA) options for account login
• Regular security audits, vulnerability assessments, and penetration testing
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Incident response procedures for detecting, reporting, and responding to personal data breaches in accordance with NPC notification requirements

While phtaa takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phtaa account credentials and for notifying us immediately at [email protected] if you suspect any unauthorized access to your account.

9. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phtaa:

• Right to be Informed: You have the right to know what personal data phtaa collects about you, the purposes for which it is processed, and how long it is retained — all of which are described in this Policy.
• Right to Access: You may request a copy of the personal data phtaa holds about you at any time by contacting our Data Protection Officer (DPO) at the details in Section 14.
• Right to Correction: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You may also update certain account details directly through your phtaa account settings.
• Right to Erasure / Right to be Forgotten: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under Philippine AML and gaming regulations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you have grounds relating to your particular situation.
• Right to Data Portability: You may request that phtaa provide your personal data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Lodge a Complaint: If you believe phtaa has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact our Data Protection Officer using the details provided in Section 14. We will respond to all verified requests within fifteen (15) business days, as required by the DPA IRR.

10. Children's Privacy and Age Restriction

The phtaa Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations. phtaa does not knowingly collect personal data from individuals under the age of 21. If we become aware that we have inadvertently collected personal data from a person under 21, we will immediately delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has registered on the phtaa Platform using false age information, please contact us immediately at [email protected] so that we can take appropriate action.

11. Cross-Border Data Transfers

phtaa primarily stores and processes your personal data within the Philippines. In certain circumstances — such as when using cloud infrastructure or third-party service providers with servers located outside the Philippines — your personal data may be transferred to and processed in other countries.

Where such transfers occur, phtaa ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under the Philippine Data Privacy Act of 2012. These safeguards may include contractual data processing agreements, standard contractual clauses, or transfers to jurisdictions recognized by the NPC as providing adequate data protection.

12. Third-Party Links and Services

The phtaa Platform may contain references to third-party payment services (such as GCash and PayMaya) that have their own privacy policies. phtaa is not responsible for the privacy practices of these third-party services. We encourage you to review the privacy policies of any third-party service you use in connection with your phtaa account.

13. Updates to This Privacy Policy

phtaa reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. When material changes are made, we will notify registered users via the email address or mobile number on file, or by posting a prominent notice on the Platform.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the phtaa Platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

14. Contact and Data Protection Officer

phtaa has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:

• Data Protection Officer, phtaa
• Email: [email protected]
• General Support: [email protected]
• Response Time: Within 15 business days of receiving your verified request

If you are not satisfied with our response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines at [email protected] (plain text — not a clickable link).