phchas Privacy Policy

1. Who We Are

This Privacy Policy is issued by phchas ("phchas," "we," "us," or "our"), the operator of the online gaming platform accessible at phchas.com. phchas operates in the Philippines and is subject to the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission ("NPC").

For the purposes of the DPA, phchas acts as the Personal Information Controller in respect of the personal data of its registered players and website visitors. Where phchas engages third-party service providers to process data on its behalf, those providers act as Personal Information Processors under written data processing agreements.

This Privacy Policy applies to all personal data collected through the phchas website, mobile platform, customer support channels, and any other touchpoint through which you interact with phchas.

2. Personal Data We Collect

phchas collects the following categories of personal data, depending on how you interact with the Platform:

phchas does not collect sensitive personal information (as defined under the DPA) beyond what is strictly necessary for identity verification and AML compliance. We do not collect biometric data, political opinions, religious beliefs, or health information.

3. How We Collect Your Data

phchas collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; payment data from GCash, PayMaya, BPI, BDO, and Metrobank; fraud signals from security service providers.

phchas will always inform you at the point of collection what data is being collected and for what purpose, consistent with the DPA's transparency requirements.

4. How We Use Your Personal Data

phchas uses your personal data for the following purposes:

• To create and manage your phchas account and verify your identity
• To process deposits and withdrawals via GCash, PayMaya, and Philippine bank accounts
• To comply with KYC, AML, and PAGCOR regulatory obligations
• To detect, investigate, and prevent fraud, money laundering, and other prohibited conduct
• To provide customer support and resolve disputes
• To monitor gaming activity for responsible gaming purposes and enforce deposit limits or self-exclusion where applicable
• To send you transactional communications (account confirmations, OTPs, withdrawal notifications)
• To send you promotional communications about phchas offers and games, where you have consented to receive them
• To improve the Platform through analytics and user research
• To enforce the phchas Terms & Conditions

phchas will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing a separate legal basis.

5. Legal Basis for Processing

Under the Philippine Data Privacy Act, phchas processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and phchas (account management, payment processing, game provision).
• Legal obligation: Processing required to comply with applicable Philippine law, including AML regulations, PAGCOR requirements, and the DPA itself.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit, informed consent. You may withdraw consent at any time.

6. Data Sharing & Disclosure

phchas does not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank, for the purpose of processing your deposits and withdrawals.
• KYC and identity verification providers: Third-party services engaged to verify your identity and age in compliance with regulatory requirements.
• Fraud prevention and security providers: Services that help phchas detect and prevent fraudulent activity on the Platform.
• Game content providers: Software providers whose games are hosted on the phchas Platform may receive anonymized session data for technical purposes.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government bodies, where disclosure is required by law or court order.
• Professional advisers: Lawyers, auditors, and accountants engaged by phchas, subject to professional confidentiality obligations.

All third-party processors engaged by phchas are bound by written data processing agreements that require them to process your data only on phchas's instructions and in compliance with the DPA.

7. Cookies & Tracking Technologies

phchas uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the phchas website.

7.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled. They include session authentication cookies and security tokens.
• Performance cookies: Collect anonymized data about how players use the Platform (pages visited, errors encountered) to help us improve the user experience.
• Functional cookies: Remember your preferences (language, display settings) to personalize your experience.
• Marketing cookies: Used to deliver relevant promotional content. These are only set with your consent.

7.2 Managing Cookies

You can control non-essential cookies through your browser settings or the phchas cookie preference center. Disabling strictly necessary cookies will affect Platform functionality. Disabling performance or marketing cookies will not affect your ability to play games or make transactions.

8. Data Security

phchas implements technical and organizational security measures appropriate to the risk level of the personal data it processes. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phchas Platform
• Encryption of sensitive data at rest, including financial data and government ID information
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Regular security audits and penetration testing by independent third parties
• Multi-factor authentication for all phchas administrative systems
• Incident response procedures compliant with the NPC's data breach notification requirements

In the event of a personal data breach that is likely to result in harm to affected individuals, phchas will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, as required by the DPA.

9. Data Retention

phchas retains your personal data for as long as your account is active and for such additional period as is required by applicable law or legitimate business necessity. The following retention periods apply:

• Account and identity data: Retained for the duration of your account plus five (5) years after account closure, in compliance with AML record-keeping requirements.
• Transaction and financial data: Retained for five (5) years from the date of the transaction, as required by Philippine AML regulations.
• Support and communications data: Retained for two (2) years from the date of the interaction.
• Technical and usage data: Retained for twelve (12) months on a rolling basis.
• Marketing consent records: Retained for the duration of your consent plus three (3) years.

Upon expiry of the applicable retention period, phchas will securely delete or anonymize your personal data in accordance with its data disposal procedures.

10. Your Data Privacy Rights

Under the Philippine Data Privacy Act, you have the following rights in respect of your personal data held by phchas:

• Right to be informed: The right to know what personal data phchas holds about you and how it is being used.
• Right of access: The right to request a copy of the personal data phchas holds about you.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
• Right to object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to data portability: The right to receive your personal data in a structured, commonly used format.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission if you believe phchas has violated your data privacy rights.

To exercise any of these rights, please contact the phchas Data Protection Officer at [email protected]. phchas will respond to all verified data subject requests within thirty (30) days.

11. Children's Privacy

The phchas Platform is strictly for individuals who are 21 years of age or older. phchas does not knowingly collect personal data from persons under 21. If phchas becomes aware that it has collected personal data from a person under 21, it will immediately close the associated account, forfeit any balance, and delete the personal data in question.

If you believe that a minor has registered on phchas, please contact our support team immediately at [email protected].

12. Cross-Border Data Transfers

Some of phchas's third-party service providers — including certain game content providers and cloud infrastructure providers — may process personal data outside the Philippines. Where such transfers occur, phchas ensures that appropriate safeguards are in place, including contractual clauses that require the recipient to protect your data to a standard equivalent to the Philippine DPA.

phchas will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without first obtaining your consent or establishing an alternative lawful transfer mechanism.

13. Changes to This Privacy Policy

phchas reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. The date of the most recent revision is displayed at the top of this page.

Material changes to this Privacy Policy will be communicated to registered players via the Platform or by notification to your registered mobile number or email address. Your continued use of the phchas Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

14. Contact & Data Protection Officer

phchas has appointed a Data Protection Officer ("DPO") as required by the Philippine Data Privacy Act. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the phchas DPO:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. Information about the NPC and how to file a complaint is available on the NPC's official website.