ph39 Privacy Policy

1.1 This Privacy Policy describes how ph39 ("ph39", "we", "us", "our") — the operator of the online gaming platform accessible at ph39.one — collects, processes, stores, shares, and protects the personal data of individuals ("you", "your", "Player") who access or use our platform and services.

1.2 This Policy applies to all personal data processing activities conducted by ph39 in connection with the operation of ph39.one, including account registration, identity verification, payment processing, gaming activity, customer support communications, and marketing where consented to.

1.3 ph39 is committed to compliance with Republic Act No. 10173 — the Data Privacy Act of 2012 (DPA) — and its Implementing Rules and Regulations, as enforced and guided by the National Privacy Commission (NPC) of the Philippines.

1.4 By registering an account on ph39, you acknowledge that you have read, understood, and agree to the collection and processing of your personal data as described in this Privacy Policy. This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy.

2.1 For the purposes of applicable data protection law, ph39 is the personal information controller with respect to the personal data of Players and visitors to ph39.one.

2.2 As data controller, ph39 determines the purposes for which personal data is collected and the means by which it is processed. Where ph39 engages third-party service providers to process personal data on its behalf, those providers act as personal information processors under ph39's documented instructions and are contractually bound to maintain data security and confidentiality standards consistent with this Policy.

2.3 ph39's designated Data Protection Officer (DPO) can be reached via the contact details set out in Section 15 of this Policy.

3.1 ph39 collects personal data through multiple channels. The categories of personal data we collect, and the primary sources of collection, are described in the table below.

3.2 ph39 does not collect sensitive personal information (as defined under the DPA) beyond what is strictly necessary for identity and age verification and anti-money laundering compliance. Specifically, ph39 does not collect religious beliefs, health information, sexual orientation, or political views from Players.

4.1 ph39 uses the personal data collected from Filipino players for the following purposes:

• Account Creation and Management: To register your account, verify your identity and age (21+), maintain your Player profile, and authenticate your login sessions on ph39.
• Service Delivery: To operate the ph39 gaming platform, process bets, record game outcomes, apply bonus credits, and maintain accurate account balances.
• Payment Processing: To process deposits from and withdrawals to your verified Philippine payment accounts (GCash, PayMaya, BPI, BDO, Metrobank, 7-Eleven), and to maintain accurate financial records.
• Legal and Regulatory Compliance: To comply with ph39's obligations under Philippine law, including the Data Privacy Act, Anti-Money Laundering Act (RA 9160 as amended), PAGCOR regulatory requirements, and lawful requests from competent authorities.
• Fraud Prevention and Security: To detect, prevent, and investigate fraudulent activity, account abuse, money laundering, and violations of ph39's Terms & Conditions, including the use of automated tools or multiple accounts.
• Responsible Gaming: To monitor gaming patterns that may indicate problem gambling behavior, to enforce deposit limits and self-exclusion orders placed by Players, and to comply with player protection obligations.
• Customer Support: To respond to your inquiries, resolve disputes, and provide assistance in connection with your use of ph39.
• Marketing Communications (where consented): To send you promotional offers, bonus notifications, and platform updates via email or SMS, subject to your communication preferences as set in your ph39 account settings.
• Platform Improvement: To analyze aggregated usage data and gaming behavior patterns to improve the performance, security, and user experience of the ph39 platform.

5.1 ph39 processes personal data only where a valid legal basis exists under the Data Privacy Act of 2012. The applicable legal bases for ph39's data processing activities are as follows:

5.2 Where ph39 relies on your consent as the legal basis for processing (specifically, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Consent can be withdrawn via your ph39 account notification settings or by contacting ph39 support.

6.1 ph39 uses cookies and similar tracking technologies on ph39.one to operate the platform and improve your experience. The types of cookies ph39 uses are as follows:

• Strictly Necessary Cookies: Essential for the operation of ph39.one. These include session authentication cookies, security tokens, and load balancing cookies. These cannot be disabled without preventing you from using ph39.
• Functional Cookies: Enable enhanced functionality such as remembering your language preference, UI customizations, and login state across sessions.
• Analytics Cookies: Used by ph39 to understand how Players navigate and interact with the platform in aggregate, allowing us to improve layout, performance, and features. Analytics data is processed in anonymized or pseudonymized form.
• Fraud and Security Cookies: Help ph39 identify suspicious access patterns, unauthorized login attempts, and bot activity, supporting the integrity and security of the ph39 platform.

6.2 You may configure your browser to refuse or delete cookies. Note that disabling strictly necessary cookies will prevent you from using ph39 and logging into your account. Disabling functional or analytics cookies may reduce the quality of your experience but will not block access to core platform features.

6.3 ph39 does not use third-party advertising cookies or behavioral retargeting technologies that track your activity across external websites.

7.1 ph39 may share your personal data with the following categories of recipients:

• Payment Processors: GCash (Mynt / Globe Fintech), PayMaya (Voyager Innovations), and banking partners (BPI, BDO, Metrobank) — solely to facilitate your authorized deposit and withdrawal transactions.
• Identity Verification Service Providers: Third-party KYC technology providers contracted by ph39 to assist in verifying the identity and age of Players. These providers are bound by strict data processing agreements and DPA-compliant confidentiality obligations.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, and courts — where ph39 is legally required or ordered to disclose information.
• Technology Service Providers: Cloud infrastructure, cybersecurity, analytics, and customer support platform providers contracted by ph39 to operate and maintain the ph39 platform. These providers act as personal information processors under ph39's documented instructions.
• Game Content Providers: Game studios (including JILI Games, Evolution Gaming, PG Soft) may receive session-level data required to operate their games within the ph39 platform. These providers do not receive Players' full personal profiles.
• Business Successors: In the event of a merger, acquisition, or sale of ph39's business assets, personal data held by ph39 may be transferred to the acquiring entity, subject to equivalent privacy protections.

7.2 Where ph39 shares your data with processors or sub-processors, ph39 ensures through contractual arrangements that those parties maintain data security and confidentiality standards at least equivalent to those described in this Policy.

8.1 ph39's primary data processing infrastructure is located in Asia-Pacific to support its Philippines-focused operations. Some of ph39's technology service providers (such as cloud infrastructure and game studio partners) may process data in jurisdictions outside the Philippines.

8.2 Where personal data is transferred outside the Philippines, ph39 takes appropriate safeguards to ensure that the transferred data is protected to a standard consistent with Philippine data protection law. These safeguards may include standard contractual clauses, data processing agreements, and transfers to jurisdictions recognized as providing adequate data protection under NPC guidance.

8.3 By using ph39 and accepting this Privacy Policy, you consent to the transfer of your personal data as described in this section, subject to the safeguards ph39 maintains.

9.1 ph39 retains your personal data for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, and to comply with applicable legal, regulatory, and accounting obligations.

9.2 The following retention principles apply:

• Active Account Data: Personal data associated with an active ph39 account is retained for the duration of the account relationship and for a minimum period of five (5) years after account closure, in compliance with Philippine anti-money laundering record-keeping requirements.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years after the end of the account relationship, consistent with AMLC and PAGCOR requirements.
• Financial Transaction Records: Deposit, withdrawal, and bet transaction records are retained for a minimum of five (5) years after the transaction date.
• Communications Data: Customer support communications are retained for a period of three (3) years from the date of the interaction, to support dispute resolution and regulatory inquiries.
• Marketing Consent Records: Records of consent and withdrawal of consent for marketing communications are retained for the duration of the account relationship and for three (3) years after account closure.

9.3 Upon the expiry of applicable retention periods, ph39 will securely delete or anonymize personal data in accordance with its data destruction procedures.

10.1 Under the Data Privacy Act of 2012, Filipino Players have the following rights with respect to their personal data held by ph39. ph39 is committed to facilitating the exercise of these rights promptly and without undue burden:

10.2 To exercise any of the rights above, submit a written request to ph39's Data Protection Officer via the contact details in Section 15. ph39 will respond to verified requests within thirty (30) calendar days. In complex cases, this period may be extended by a further thirty (30) days with notice to you.

10.3 ph39 may require you to verify your identity before processing a data rights request to prevent unauthorized access to your personal data by third parties.

11.1 ph39 enforces age verification at registration through mandatory KYC documentation review. Players who cannot provide satisfactory proof of age will not be permitted to complete registration or engage in real-money play.

11.2 If you are a parent or guardian and you believe your minor child has provided personal data to ph39, please contact ph39 support immediately at the details in Section 15. ph39 will investigate the matter and delete any data confirmed to belong to a person under 21.

12.1 ph39 implements a range of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between your browser or device and ph39 servers;
• Encryption at rest for sensitive personal data and financial records stored in ph39 systems;
• Role-based access controls restricting internal access to personal data to authorized personnel with a verified operational need;
• Multi-factor authentication for ph39 staff accessing internal systems containing player data;
• Continuous security monitoring, intrusion detection, and regular penetration testing of ph39's infrastructure;
• Documented incident response procedures, including breach notification protocols consistent with NPC requirements.

12.2 In the event of a personal data breach that is likely to pose a real risk to affected Players, ph39 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected Players without undue delay, as required by the DPA and NPC Circular 16-03.

12.3 While ph39 takes extensive security precautions, no method of electronic transmission or storage is completely secure. ph39 encourages all Players to use strong, unique passwords for their ph39 accounts and to enable two-factor authentication as an additional safeguard.

13.1 The ph39 platform may contain links to game providers' interfaces and payment processing screens operated by third parties. When you interact with a third-party service through ph39 (for example, completing a GCash authorization on the GCash-operated payment screen), your interactions with that third-party screen are governed by that third party's own privacy policy and terms.

13.2 ph39 is not responsible for the privacy practices or content of any third-party services. ph39 recommends that Players review the privacy policies of any third-party services they interact with in connection with the use of ph39.

14.1 ph39 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, platform features, applicable law, or regulatory guidance from the NPC.

14.2 When material changes are made to this Privacy Policy — meaning changes that significantly affect how your personal data is processed, or that affect your rights as a data subject — ph39 will:

• Update the "Effective Date" displayed at the top of this page;
• Provide notice to registered Players via email or prominent on-platform notification at least fourteen (14) days before the revised Policy takes effect; and
• Where required by law, obtain fresh consent before processing your data under the revised terms.

14.3 Non-material changes (such as clarifications, formatting corrections, or updates that strengthen your rights) may be made at any time without advance notice. Your continued use of ph39 after the effective date of a revised Privacy Policy constitutes your acknowledgment of the updated Policy.

15.1 For any questions, concerns, or requests related to this Privacy Policy or the handling of your personal data by ph39, please contact ph39's Data Protection Officer through the following channels:

15.2 If you are not satisfied with ph39's response to a privacy concern or data rights request, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines, the competent supervisory authority for data protection matters in the Philippines. The NPC's official website and complaint portal are publicly accessible.

15.3 ph39 encourages Players to contact ph39 in the first instance before lodging an NPC complaint, as many concerns can be resolved quickly through ph39's support and DPO channels.