phl99 Privacy Policy

This Privacy Policy ("Policy") describes how phl99 ("phl99," "we," "us," "our"), the operator of the online gaming platform accessible at phl99.club ("Platform"), collects, uses, stores, discloses, and protects the personal data of individuals ("Players," "Users," "you") who register for, access, or use the Platform.

phl99 is committed to protecting the privacy of all Filipino players who use the Platform. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

By registering for a phl99 account or using any part of the Platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Policy, you must not register for or use the phl99 Platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual.
• "Sensitive Personal Information" includes government-issued identification numbers, financial information, health data, and other categories defined as sensitive under the Data Privacy Act of 2012.
• "Processing" refers to any operation or set of operations performed upon personal data including collection, recording, organization, storage, updating, retrieval, consultation, use, disclosure, combination, blocking, erasure, or destruction.
• "Data Controller" means phl99, which determines the purposes and means of the processing of personal data collected through the Platform.
• "Data Processor" means any natural or legal person that processes personal data on behalf of phl99 pursuant to a data processing agreement.
• "Data Protection Officer (DPO)" means the individual designated by phl99 to oversee compliance with data privacy obligations and to serve as the point of contact for data subjects.
• "KYC" means Know Your Customer — identity verification required under Philippine AML regulations.
• "NPC" means the National Privacy Commission of the Philippines.

phl99 collects personal data necessary to provide and operate the Platform, comply with legal obligations, and deliver a safe and fair gaming experience. The categories of personal data we collect are set out in the table below.

phl99 collects personal data through the following channels and mechanisms:

4.1 Directly from You

• When you register for a phl99 account and submit your registration details;
• When you complete KYC verification by uploading identity documents;
• When you make a deposit or request a withdrawal and provide payment account details;
• When you contact phl99 customer support via live chat, email, or other communication channels;
• When you respond to surveys, participate in promotions, or provide feedback.

4.2 Automatically through Platform Use

• Device identifiers, IP address, and browser data collected automatically when you access the Platform;
• Session activity data generated as you navigate the Platform, access games, and conduct transactions;
• Cookies and similar tracking technologies as described in Section 11.

4.3 From Third Parties

• Identity verification results from KYC service providers;
• Transaction confirmation data from payment processors (GCash, Maya, BPI, BDO, Metrobank);
• Fraud risk signals from fraud prevention service providers;
• Self-exclusion status from applicable gaming exclusion registers.

phl99 processes your personal data only for specific, legitimate purposes directly related to the provision of the Platform and compliance with applicable Philippine law. The purposes for which we use your data are as follows:

• Account Operation: creating, managing, and maintaining your phl99 account, including authentication and account security;
• Payment Processing: processing deposits, withdrawals, and refunds through your registered Philippine payment accounts;
• Identity Verification (KYC): verifying your identity to comply with Philippine AML regulations and gaming regulatory requirements prior to withdrawal processing;
• Regulatory Compliance: meeting phl99's obligations under the Anti-Money Laundering Act (AMLA), Data Privacy Act, and applicable Philippine gaming regulations, including mandatory reporting to PAGCOR and the Anti-Money Laundering Council (AMLC) where required;
• Fraud Detection and Prevention: monitoring transactions and account activity to detect and prevent fraud, money laundering, and other prohibited conduct;
• Responsible Gaming: monitoring gaming patterns to identify indicators of problem gambling behavior and to administer responsible gaming tools including deposit limits, session timers, and self-exclusion;
• Customer Support: responding to your queries, resolving disputes, and managing complaints;
• Platform Improvement: analyzing usage patterns to improve Platform functionality, user experience, and game library curation;
• Marketing Communications: sending promotional offers, bonus notifications, and platform updates to registered players who have consented to receive such communications. Players may opt out at any time.

phl99 processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Contractual Necessity: processing necessary to perform our contractual obligations to you under the phl99 Terms and Conditions — including account operation, payment processing, and game access;
• Legal Obligation: processing required to comply with applicable Philippine laws and regulations, including the Anti-Money Laundering Act, PAGCOR licensing requirements, and orders from competent authorities;
• Legitimate Interests: processing necessary for phl99's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your privacy rights;
• Consent: where required by law, processing based on your freely given, specific, informed, and unambiguous consent — including for direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

phl99 shares personal data only to the extent necessary to operate the Platform and fulfill legal obligations. We do not disclose personal data to third parties for their independent commercial use. The categories of recipients to whom we may disclose personal data are as follows:

7.1 Service Providers (Data Processors)

phl99 engages third-party service providers to assist in delivering the Platform. These providers process personal data only on phl99's instructions and are bound by data processing agreements that require them to apply appropriate technical and organizational security measures. Categories include:

• Payment processors — GCash, Maya, GrabPay, BPI, BDO, Metrobank, QR Ph, and 7-Eleven CLiQQ;
• KYC and identity verification service providers;
• Fraud detection and AML screening providers;
• Customer support technology providers;
• Cloud infrastructure and hosting providers;
• Analytics service providers (aggregated and anonymized data only where possible).

7.2 Regulatory and Legal Authorities

phl99 may disclose personal data to Philippine regulatory authorities, law enforcement agencies, courts, or other government bodies where required by applicable law, court order, or legitimate regulatory inquiry. This includes mandatory reporting to PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC) in their respective regulatory capacities.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of phl99's assets, personal data held by phl99 may be transferred to the acquiring entity, subject to the same privacy protections established in this Policy. Players will be notified of any such transfer via their registered contact details prior to the transfer taking effect.

7.4 With Your Consent

phl99 may share personal data with additional third parties where you have given explicit, specific consent to such sharing.

phl99 implements and maintains comprehensive technical and organizational security measures designed to protect your personal data against unauthorized access, accidental or unlawful loss, alteration, disclosure, or destruction. Our security framework includes the following measures:

• Encryption in Transit: all data transmitted between your device and the phl99 Platform is encrypted using 256-bit SSL/TLS encryption, ensuring that data cannot be intercepted in transit;
• Encryption at Rest: sensitive personal data stored on phl99 systems, including KYC documents and payment account information, is encrypted at rest using AES-256 encryption;
• Password Hashing: user account passwords are hashed using industry-standard cryptographic algorithms and are never stored in plain text. phl99 staff cannot retrieve your original password;
• Access Controls: access to personal data is restricted to authorized phl99 personnel and service providers on a strict need-to-know basis. All access is logged and subject to regular review;
• Two-Factor Authentication: phl99 provides and recommends SMS-based 2FA for all player accounts to protect against unauthorized login;
• Security Monitoring: phl99's security team continuously monitors Platform infrastructure for anomalous activity, unauthorized access attempts, and potential security incidents;
• Incident Response: phl99 maintains a documented data breach response plan. In the event of a personal data breach that is likely to affect your rights, phl99 will notify affected players and the National Privacy Commission (NPC) in accordance with the Data Privacy Act's breach notification requirements.

phl99 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable mandatory retention requirements under Philippine law. The following retention periods apply to key data categories:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to any identifiable individual, unless continued retention is required by a specific legal obligation, ongoing regulatory investigation, or unresolved dispute.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by phl99. These rights may be exercised by contacting phl99's Data Protection Officer as described in Section 15.

To exercise any of your rights, submit a written request to phl99's Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request." phl99 will respond within 15 business days of receiving a valid, verified request. We may need to verify your identity before processing your request to prevent unauthorized access to personal data.

If you are unsatisfied with phl99's response to your data privacy request or believe that your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) of the Philippines.

phl99 uses cookies and similar tracking technologies on the Platform to enable essential functionality, improve user experience, and support security monitoring. The following categories of cookies are used:

• Strictly Necessary Cookies: essential for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled as they are required for the Platform to operate.
• Functional Cookies: remember your preferences such as language settings, last-played games, and account display options. Disabling these cookies may affect Platform functionality.
• Analytics Cookies: collect aggregated, anonymized information about how players use the Platform to help phl99 improve performance and navigation. Analytics data is processed at an aggregated level and does not identify individual users.
• Security Cookies: support fraud detection and login security by enabling phl99's systems to identify recognized devices and detect anomalous session behavior.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to refuse non-essential cookies, clear existing cookies, and configure cookie behavior on a per-site basis. Note that disabling strictly necessary cookies will prevent you from logging into and using the phl99 Platform. phl99 does not currently use third-party advertising cookies or behavioral retargeting technologies.

The phl99 Platform is strictly intended for individuals who are 21 years of age or older. phl99 does not knowingly collect personal data from persons under the age of 21. If phl99 discovers or is informed that personal data has been collected from a person under 21, the associated account will be immediately closed and the collected data deleted as promptly as practicable, subject to any overriding legal retention obligations.

The phl99 Platform integrates with third-party payment services including GCash, Maya, GrabPay, BPI, BDO, and Metrobank to facilitate deposits and withdrawals. When you initiate a payment through one of these services, you are subject to that service provider's own privacy policy and terms of use. phl99 is not responsible for the data practices of third-party payment providers.

The Platform may contain references or links to information pages of third-party organizations. phl99 is not responsible for the privacy practices of any third-party website or service accessed through or referenced from the Platform. Users are encouraged to review the privacy policies of any third-party service they use in connection with their phl99 account.

phl99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance. When material changes are made, phl99 will notify registered Players through one or more of the following channels: in-platform notification, SMS to the registered mobile number, or email to the registered address. The revised Policy will be published at phl99.club/privacy-policy with an updated Effective Date.

Your continued use of the phl99 Platform after the notified effective date of any amendment constitutes your acknowledgment of the updated Policy. If you disagree with any amendment, you may request account closure in accordance with the phl99 Terms and Conditions. phl99 recommends reviewing this Policy periodically to remain informed of how your personal data is handled.

phl99 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and with the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Policy or to your personal data held by phl99, please contact the DPO using the details below.

• Data Protection Officer — phl99
• Email: [email protected] — Subject line: "Data Privacy Rights Request" or "Privacy Inquiry"
• Response Time: within 15 business days of receiving a valid, verified request
• Support Hours: 24 hours a day, 7 days a week, Philippine Time (PHT)

For formal data privacy complaints that have not been resolved to your satisfaction by phl99, you may contact the National Privacy Commission (NPC) of the Philippines, the independent government body responsible for administering and enforcing the Data Privacy Act of 2012.