ph935 Privacy Policy

ph935 ("ph935," "we," "us," or "our") is committed to protecting the privacy and personal data of every individual who uses the ph935 online gaming platform available at ph935.app (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by ph935.

This Policy applies to all users of the ph935 Platform, including registered Players, visitors who browse the Platform without registering, and individuals who contact ph935 through any support channel. It applies regardless of whether you access the Platform from Metro Manila, Cebu, Davao, or any other location in the Philippines.

ph935 processes personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, as administered by the National Privacy Commission ("NPC"). We are registered with the NPC as a personal information controller. By using the ph935 Platform, you acknowledge that you have read and understood this Privacy Policy and that you consent to the processing of your personal data as described herein, to the extent that consent is the applicable lawful basis for that processing.

In this Privacy Policy, the following terms carry the meanings assigned below:

ph935 is the Personal Information Controller responsible for the personal data collected through the Platform. ph935 operates under PAGCOR regulatory oversight and is subject to the requirements of both the DPA and PAGCOR's data protection guidelines as they apply to licensed online gaming operators in the Philippines.

ph935 collects the following categories of personal data in the course of operating the Platform:

4.1 Registration and Identity Data

• Full legal name as it appears on your Philippine government-issued identification document;
• Date of birth (for age verification — must confirm 21 years of age or older);
• Gender;
• Residential address, including barangay, city or municipality, and province;
• Philippine mobile number;
• Email address;
• Username and encrypted password hash.

4.2 Identity Verification (KYC) Data

• Copies of government-issued Philippine identification documents, which may include the PhilSys National ID, passport, LTO Driver's Licence, SSS UMID Card, GSIS eCard, PRC ID, or COMELEC Voter's ID;
• Selfie or liveness check image captured during the KYC verification process;
• Source of funds declarations where required for enhanced due diligence.

4.3 Financial Transaction Data

• GCash mobile number and masked account identifier;
• Maya account identifier;
• Bank account details (BPI, BDO, Metrobank, UnionBank, or other supported Philippine banks) where bank transfer is used, stored in masked form;
• Deposit and withdrawal transaction history, including amounts in Philippine Peso (PHP) and timestamps;
• Running account balance.

4.4 Gaming Activity Data

• Game session records including games played, wager amounts, outcomes, and timestamps;
• Sports betting selections and settlement records on MT Live;
• Bonus and promotion uptake and wagering requirement progress;
• Responsible gaming tool activations, including deposit limits, session limits, and self-exclusion records.

4.5 Technical and Device Data

• IP address at the time of each login and transaction;
• Device type, operating system, and browser version;
• Geolocation data (country and approximate region, derived from IP address);
• Session duration and navigation path data;
• Cookies and similar tracking identifiers, as described in Section 8.

4.6 Communications Data

• Records of all communications between you and ph935 support, including live chat transcripts, email correspondence, and support ticket content;
• Survey responses and feedback submitted voluntarily by Players.

ph935 collects personal data through the following channels:

• Direct provision: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated technical collection: IP address, device data, and session information collected automatically when you access or use the Platform;
• Cookies and similar technologies: Data collected through cookies, web beacons, pixel tags, and local storage mechanisms, as described in Section 8;
• Third-party verification services: Identity verification data returned by ph935's KYC processing partner following document verification;
• Payment processors: Transaction confirmation data returned by GCash, Maya, or Philippine banking partners following completion of a deposit or withdrawal;
• PAGCOR and regulatory sources: Self-exclusion status data shared by PAGCOR through its national exclusion registry.

ph935 processes your personal data on one or more of the following lawful bases as provided under the DPA:

ph935 uses the personal data it collects for the following purposes:

• Account administration: Creating and managing your ph935 Account, verifying your identity and age, maintaining your account balance, and processing deposits and withdrawals in PHP;
• Service delivery: Providing access to all games on the Platform, including live dealer tables, slots, bingo, dragon fishing, and MT Live sports betting;
• Regulatory compliance: Fulfilling ph935's obligations under its PAGCOR licence, including player verification, transaction monitoring, AML reporting, and self-exclusion enforcement;
• Fraud prevention and security: Detecting and investigating suspicious account activity, unauthorised access attempts, bonus abuse, and potential money laundering;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour, enforcing player-set limits, and administering self-exclusion requests;
• Customer support: Responding to your inquiries, resolving disputes, and maintaining records of communications for quality and training purposes;
• Promotions: Administering bonus offers and promotional campaigns that you have opted into, including verifying eligibility and tracking wagering requirement completion;
• Platform improvement: Analysing aggregated, anonymised usage data to improve the Platform's features, performance, and user experience;
• Marketing communications: Sending you promotional emails, SMS messages, or in-platform notifications about ph935 offers and new game releases — only where you have given consent and subject to your right to withdraw that consent at any time.

ph935 uses cookies and similar technologies to operate the Platform, remember your preferences, maintain your login session, and analyse how the Platform is used. A cookie is a small text file placed on your device when you visit a website. Cookies on the ph935 Platform fall into the following categories:

You can manage your cookie preferences through the cookie settings panel available on the Platform. Disabling strictly necessary cookies will prevent you from logging into your ph935 Account. ph935 does not use third-party advertising networks or allow external cookie-based tracking on the Platform.

ph935 does not sell, rent, or trade your personal data to any third party for commercial purposes. ph935 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to binding contractual data protection obligations:

• PAGCOR and Philippine regulatory authorities: Disclosure of player account data, transaction records, and identity documentation as required by ph935's PAGCOR licence obligations, anti-money laundering reporting requirements, and PAGCOR self-exclusion registry cross-referencing;
• Philippine law enforcement agencies: Where ph935 is required by court order, subpoena, or other lawful authority to disclose personal data in connection with a criminal investigation or legal proceeding;
• KYC verification partners: Identity document images and selfie data transmitted to ph935's certified KYC processing partner solely for the purpose of age and identity verification. These partners are bound by DPA-compliant data processing agreements and do not retain data beyond the verification period;
• Payment processors: Transaction data shared with GCash, Maya, BPI, BDO, Metrobank, and other Philippine payment providers as necessary to process your deposits and withdrawals;
• Game providers: Anonymised session and wagering data shared with certified game providers (such as JILI, PG Soft, and Pragmatic Play) for game performance monitoring and RTP audit purposes. No personally identifiable information is included in data shared with game providers;
• Technology and infrastructure providers: Cloud hosting, security, and platform infrastructure providers operating data centres used by ph935, all of whom are subject to binding data processing agreements consistent with DPA requirements;
• Professional advisors: Legal, audit, and compliance advisors engaged by ph935 in the ordinary course of business, subject to professional confidentiality obligations.

Some of ph935's technology infrastructure and third-party service providers operate servers or processing facilities outside the Philippines. Where personal data is transferred to a country outside the Philippines, ph935 ensures that such transfers are made only:

• To countries or organisations that the NPC has determined provide an adequate level of data protection comparable to that available under the DPA; or
• Under standard contractual clauses approved by the NPC or equivalent binding data transfer agreements that impose obligations on the receiving party consistent with the DPA's requirements; or
• Where the transfer is necessary for the performance of the contract between you and ph935 (for example, processing a GCash transaction through international banking infrastructure).

ph935 does not transfer Sensitive Personal Information — including KYC documents and financial account details — to servers located outside of ASEAN-region data centres except where strictly required by regulatory or legal obligation and subject to the protections described above.

ph935 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer period as is required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with NPC-approved data disposal procedures. Data that has been anonymised — meaning it can no longer be used to identify you — may be retained for statistical analysis purposes without time limit.

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph935. These rights may be exercised by contacting the ph935 Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request," together with sufficient information to verify your identity.

ph935 will respond to verifiable data rights requests within fifteen (15) business days of receipt. Where a request cannot be fulfilled within that period due to complexity, ph935 will notify you of the extended timeline and the reason for the extension. ph935 will not charge a fee for processing standard data rights requests.

ph935 implements technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, accidental loss, and destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the ph935 Platform is encrypted using TLS 1.3 with 256-bit cipher strength;
• Encryption at rest: Sensitive personal data — including KYC documents, financial account identifiers, and password hashes — is stored using AES-256 encryption on ph935's servers;
• Access controls: Access to personal data within ph935's internal systems is restricted on a strict need-to-know basis, with role-based access controls and audit logging of all access events;
• Password security: Account passwords are never stored in plaintext. ph935 uses bcrypt hashing with a work factor calibrated to current computational threat levels;
• Two-factor authentication: Optional 2FA is available to all Players and strongly recommended. ph935 staff accounts accessing player data require mandatory 2FA;
• Regular security assessments: ph935 conducts periodic penetration testing and vulnerability assessments on the Platform's infrastructure and application stack;
• Incident response: ph935 maintains a documented data breach response procedure. In the event of a breach that poses a risk to your rights and freedoms, ph935 will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected data subjects without undue delay.

While ph935 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. Players are responsible for maintaining the security of their own Account credentials and for using secure internet connections when accessing the ph935 Platform, particularly when accessing from public Wi-Fi networks in locations across Metro Manila, Cebu, or elsewhere in the Philippines.

ph935's registration and KYC processes are specifically designed to prevent access by individuals under 21 years of age. Age is verified through mandatory submission of a Philippine government-issued identification document during the KYC process. Where ph935 discovers or reasonably suspects that personal data has been collected from an individual under the age of 21 — whether through misrepresentation or otherwise — ph935 will immediately close the relevant Account, delete the associated personal data (except where retention is required for legal or regulatory reasons), and report the matter to PAGCOR as required by ph935's licence conditions.

The ph935 Platform does not contain links to external third-party websites or services. All navigation within the Platform is confined to pages and features operated directly by ph935 under the ph935.app domain. ph935 is not responsible for the privacy practices of any third-party service providers accessed independently by Players outside the Platform, including the GCash and Maya applications used to initiate deposits and withdrawals.

ph935 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they affect your rights as a data subject or significantly change how ph935 processes your personal data — ph935 will provide notice to registered Players via the email address associated with their Account no less than fourteen (14) days before the amended Policy takes effect.

For non-material amendments, including clarifications of existing language, typographical corrections, or updates required to reflect changes in applicable law, the updated Policy will be published on the Platform with the updated effective date. Your continued use of the ph935 Platform following the effective date of any amendment constitutes acknowledgment of the updated Policy.

The version of this Privacy Policy that was in force at the time any personal data was collected from you will be the version that governs ph935's use of that data, except where ph935 is legally required to apply a later version retrospectively.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ph935, please contact our Data Protection Officer using the details below. We take all privacy inquiries seriously and will respond within the timeframe required by the DPA.

If you are not satisfied with ph935's response to a data privacy inquiry or complaint, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. Details of the NPC's complaint process are available through the NPC's official channels. ph935 will cooperate fully with any NPC investigation arising from a complaint relating to our data processing activities.