phcah Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how phcah ("the Company," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you," "your," or "Data Subject") who access or use the phcah platform, including the website at phcah.app, all associated online gaming services, and all interactions with phcah's customer support channels.

By registering a phcah account, using the phcah platform, or continuing to browse phcah.app, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must discontinue your use of the phcah platform and may request account closure.

phcah processes personal data in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR). Where applicable, phcah also observes the privacy and data protection guidelines issued by PAGCOR and other relevant Philippine regulatory authorities.

2. Data Controller

The Data Controller responsible for your personal information collected through the phcah platform is phcah, operating the online gaming platform at phcah.app. All inquiries relating to this Privacy Policy, data subject rights requests, and concerns regarding phcah's handling of personal data should be directed to phcah's Data Protection Officer (DPO), whose contact details are set out in Section 14 of this Policy.

As Data Controller, phcah determines the purposes and means of processing personal data collected through the platform. Where phcah engages third-party processors (for example, payment gateway providers or game software suppliers), such processors handle data strictly under written data processing agreements consistent with the requirements of the Philippine Data Privacy Act.

3. Personal Data We Collect

phcah collects personal data that is necessary to provide, operate, and secure the phcah platform and comply with applicable regulatory requirements. The categories of personal data phcah collects include:

3.1 Registration and Identity Data

• Full legal name as it appears on a government-issued Philippine ID;
• Date of birth (to verify that you are 21 years of age or older);
• Philippine mobile number;
• Email address;
• Username and encrypted password;
• Residential address within the Philippines;
• Gender (where provided voluntarily).

3.2 Identity Verification (KYC) Data

• Government-issued Philippine identification documents (e.g., PhilSys National ID, passport, driver's license, SSS/GSIS ID, PRC ID, voter's ID);
• Selfie or facial image submitted for identity matching purposes;
• Proof of address documents (e.g., utility bills, bank statements);
• Source of funds documentation, where required by anti-money laundering compliance.

3.3 Financial and Transaction Data

• GCash account number or mobile number linked to GCash (partial, for transaction reference);
• PayMaya account reference details;
• Bank account details (BPI, BDO, Metrobank, UnionBank) for bank transfer transactions — stored in encrypted form;
• Full transaction history including deposits, withdrawals, and gaming activity on phcah;
• Bonus and promotion redemption records.

3.4 Gaming and Behavioral Data

• Bet history, game sessions, wager amounts, and outcomes across all phcah games including slots, live dealer tables, bingo, Monster Dice, and sports betting;
• Time and duration of platform sessions;
• Responsible gaming preferences, including deposit limits and self-exclusion requests.

3.5 Technical and Device Data

• IP address and approximate geolocation (region/city level);
• Device type, operating system, and browser information;
• Session cookies and authentication tokens;
• Platform usage logs and error reports.

3.6 Communications Data

• Records of live chat conversations with phcah customer support;
• Email correspondence with phcah;
• Responses to phcah surveys or feedback requests (where voluntarily submitted).

4. How We Collect Your Data

phcah collects personal data through the following means:

• Direct collection: Information you provide when creating a phcah account, completing KYC verification, making deposits or withdrawal requests, contacting phcah support, or participating in promotions;
• Automated technical collection: Data automatically collected when you access phcah.app, including IP address, device information, browser type, and cookies;
• Payment processor data: Transaction confirmation and reference data received from GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank when you initiate a financial transaction on phcah;
• Third-party identity verification: Data received from KYC and age verification service providers engaged by phcah to confirm your identity and age eligibility;
• Platform usage data: Gaming activity, session data, and behavioral analytics generated automatically by your interaction with the phcah platform.

5. Purpose and Legal Basis for Processing

phcah processes your personal data for the following purposes, each supported by a lawful basis under the Philippine Data Privacy Act:

6. Sharing and Disclosure of Personal Data

phcah does not sell, rent, or trade your personal data to third parties for commercial purposes. phcah may share your personal data with the following categories of recipients strictly for the purposes described in this Policy:

6.1 Service Providers and Data Processors

phcah engages carefully selected third-party service providers who process data on phcah's behalf under written agreements that impose data protection obligations consistent with the Philippine Data Privacy Act. These include:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank, for the sole purpose of processing your deposit and withdrawal transactions;
• KYC and identity verification providers: For age verification and identity authentication to ensure compliance with the 21+ requirement and AML obligations;
• Game software providers: JILI, PG Soft, Pragmatic Play, and other licensed game suppliers, who receive only the minimum data required to operate game sessions;
• Cloud hosting and infrastructure providers: For secure storage and processing of platform data.

6.2 Regulatory and Legal Disclosures

phcah may disclose personal data to Philippine government authorities, regulatory bodies, law enforcement agencies, and courts where required to do so by law, court order, or regulatory direction — including disclosures required by PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC).

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of phcah's assets, your personal data may be transferred as part of that transaction. phcah will provide reasonable notice to affected Players in such circumstances and ensure that the recipient is bound by data protection obligations no less stringent than those in this Policy.

7. Data Retention

phcah retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required or permitted by applicable Philippine law. The following general retention periods apply:

• Account and KYC data: Retained for the duration of your phcah account plus a minimum of 5 years following account closure, as required by anti-money laundering and gaming regulatory compliance obligations;
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with AMLC and tax record-keeping requirements;
• Gaming activity and bet history: Retained for a minimum of 3 years for dispute resolution, responsible gaming monitoring, and regulatory reporting;
• Customer support communications: Retained for 2 years from the date of each interaction, unless a related dispute or investigation requires longer retention;
• Marketing consent records: Retained for the duration of your marketing subscription plus 1 year following withdrawal of consent;
• Technical and server logs: Retained for 12 months, after which they are aggregated, anonymized, or deleted.

When personal data is no longer required for the purposes set out above and no legal obligation requires further retention, phcah will securely delete or anonymize it.

8. Cookies and Tracking Technologies

phcah uses cookies and similar tracking technologies on phcah.app to operate the platform, remember your preferences, and analyze platform usage. A "cookie" is a small text file stored on your device when you visit a website.

8.1 Types of Cookies Used by phcah

• Essential cookies: Required for phcah to function — these maintain your logged-in session, secure your phcah login authentication token, and enable core platform features. These cannot be disabled without breaking the platform.
• Functional cookies: Remember your language preference, game settings, and platform personalization choices on phcah.
• Analytical cookies: Used by phcah to understand how Filipino players use the platform — which games are most popular, which pages have high exit rates, and where technical errors occur. This data is aggregated and used to improve the phcah experience.
• Security cookies: Detect fraudulent logins, bot activity, and suspicious behavior to protect phcah accounts.

phcah does not use advertising or tracking cookies to build behavioral profiles for sale to third-party advertisers.

9. Data Security

phcah implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and phcah servers;
• Encryption at rest for sensitive personal data and financial information stored in phcah systems;
• Access control policies limiting personal data access to authorized phcah personnel on a strict need-to-know basis;
• Two-factor authentication (OTP verification) on the phcah login process for new or unrecognized devices;
• Regular security audits and penetration testing of the phcah platform;
• Incident response procedures for detecting, containing, and notifying affected parties of any personal data breaches.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173) and its IRR, you have the following rights with respect to your personal data held by phcah:

• Right to be Informed: You have the right to be informed of how your personal data is being collected, processed, and used by phcah — which is the purpose of this Privacy Policy;
• Right of Access: You have the right to request a copy of the personal data phcah holds about you, and to receive information about how it is being processed;
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data phcah holds about you;
• Right to Erasure or Blocking: You have the right to request that phcah delete or block processing of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing is unlawful — subject to phcah's legal retention obligations;
• Right to Object: You have the right to object to the processing of your personal data for marketing purposes or where phcah relies on legitimate interests as its legal basis, in certain circumstances;
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible;
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe phcah has violated your data privacy rights under Philippine law.

To exercise any of the above rights, please contact phcah's Data Protection Officer using the contact details in Section 14. phcah will respond to verified data subject rights requests within 15 business days of receipt, unless a legitimate extension is required under applicable law.

11. Children and Minors

If phcah discovers that personal data has been collected from a person under 21 years of age, it will immediately delete such data, close the associated account, and refund any deposits to the original payment source. No winnings generated by an underage account will be paid. If you believe phcah has inadvertently collected data from a minor, please notify phcah's DPO immediately at the contact details in Section 14.

12. Third-Party Links and Integrations

The phcah platform may contain references or integrations relating to third-party services, including payment providers such as GCash and PayMaya. When you leave phcah.app and interact with a third-party platform or service, that platform's own privacy policy governs the collection and use of your data. phcah is not responsible for the privacy practices of third-party services. phcah encourages Players to review the privacy policies of any third-party service they interact with when using the phcah platform.

13. Changes to This Privacy Policy

phcah reserves the right to update or amend this Privacy Policy at any time. When material changes are made, phcah will publish the revised Policy on phcah.app with an updated "Last Updated" date at the top of the document. Where a change materially affects your rights as a data subject, phcah will provide prior notice via registered email or in-platform notification before the change takes effect.

Your continued use of the phcah platform after a Privacy Policy update constitutes your acknowledgment and acceptance of the revised Policy. If you do not accept the revised terms, you must cease using phcah and may request account closure by contacting phcah support.

14. Contact and Data Protection Officer

For all privacy-related inquiries, data subject rights requests, complaints, or concerns regarding phcah's handling of personal data, please contact phcah's Data Protection Officer (DPO):

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC). For information on how to file a complaint with the NPC, please visit the NPC's official website or contact their public assistance desk.