ph649 Privacy Policy

ph649 ("we", "us", "our", or "ph649") is committed to protecting the privacy and personal data of all individuals who access, register on, or interact with the ph649 online gaming platform at ph649.org ("the Platform"). This Privacy Policy explains how ph649 collects, uses, discloses, stores, and safeguards your personal information in connection with your use of the Platform and its associated services.

This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission of the Philippines ("NPC"). It also reflects ph649's obligations as a regulated gaming operator under the oversight of the Philippine Amusement and Gaming Corporation ("PAGCOR").

This Privacy Policy should be read alongside ph649's Terms and Conditions and Responsible Gaming Policy, both of which are available on the Platform.

For the purposes of the Philippine Data Privacy Act of 2012, the data controller responsible for personal data collected through ph649.org is the Operator — the legal entity that owns and operates the ph649 Platform. The Operator has registered a Data Protection Officer ("DPO") with the National Privacy Commission as required by applicable law.

The Operator determines the purposes and means of processing personal data collected through ph649 and bears primary responsibility for ensuring that all processing activities comply with Republic Act No. 10173 and PAGCOR regulatory requirements.

Contact details for the ph649 Data Protection Officer are provided in Section 15 of this Privacy Policy.

ph649 collects the following categories of personal data in connection with your use of the Platform:

3.1 Registration and Identity Data

3.2 Financial Data

ph649 collects payment method identifiers, transaction amounts, and transaction timestamps in connection with deposit and withdrawal processing. ph649 does not store full credit or debit card numbers. GCash and Maya account identifiers are stored only in hashed or tokenised form. Full bank account numbers are not retained beyond the point of transaction processing.

3.3 Gaming and Behavioural Data

ph649 collects records of game sessions, wager amounts, win/loss outcomes, bonus transactions, and game preferences associated with your Account. This data is used for account management, regulatory reporting, responsible gaming monitoring, and personalisation of the Platform experience.

3.4 Technical Data

ph649 collects device information (operating system, device model, screen resolution), IP address, browser type and version, session duration, and pages visited within the Platform. This data is used for security, fraud prevention, performance optimisation, and aggregate analytics.

3.5 Communications Data

When you contact ph649 support via live chat or email, ph649 retains records of those communications, including the content of messages, for quality assurance, dispute resolution, and regulatory compliance purposes.

ph649 collects personal data through the following methods:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated collection: Technical and behavioural data collected automatically through server logs, cookies, and similar tracking technologies when you access and interact with the Platform. See Section 11 for details on cookies.
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance service providers; payment confirmation data from GCash, Maya, BPI, BDO, Metrobank, Coins.ph, and other payment processors.
• Regulatory sources: Self-exclusion registers and player protection information maintained by PAGCOR or other regulated gaming operators where applicable.

ph649 processes your personal data for the following purposes:

ph649 processes personal data only where a valid legal basis exists under the Philippine Data Privacy Act of 2012. The following legal bases apply to ph649's processing activities:

1. Contractual necessity: Processing necessary to perform the contract between ph649 and you as a registered Player — including account management, game provision, payment processing, and loyalty programme administration.
2. Legal obligation: Processing necessary to comply with ph649's legal obligations under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (Republic Act No. 9160 as amended), and the Data Privacy Act of 2012.
3. Legitimate interests: Processing necessary for ph649's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your privacy rights.
4. Consent: Processing for direct marketing communications, where ph649 relies on your freely given, specific, and informed consent. Consent can be withdrawn at any time by updating your communication preferences or contacting ph649 support.

ph649 does not sell personal data. ph649 shares personal data with third parties only in the following circumstances:

7.1 Service Providers (Data Processors)

ph649 engages third-party service providers who process personal data on ph649's behalf and under ph649's instructions, including:

• KYC and identity verification providers;
• Payment processors and e-wallet operators (GCash, Maya, BPI, BDO, Metrobank, Coins.ph);
• Cloud infrastructure and hosting providers;
• Customer support platform providers;
• AML and fraud screening services;
• Analytics and platform performance services.

All service providers are bound by data processing agreements that prohibit them from using personal data for any purpose other than the specific service being provided to ph649.

7.2 Regulatory Disclosure

ph649 may be required to disclose personal data to PAGCOR, the Anti-Money Laundering Council ("AMLC"), the NPC, Philippine courts, or other competent authorities pursuant to lawful orders, regulatory requirements, or legal process. ph649 will notify affected Players of such disclosures where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving the Operator, personal data held by ph649 may be transferred to the acquiring entity as part of the transaction. Affected Players will be notified prior to their personal data being subject to a materially different privacy policy as a result of such a transfer.

Some of ph649's service providers operate infrastructure or personnel in jurisdictions outside the Philippines. Where personal data is transferred to countries that do not provide a level of data protection equivalent to Philippine law, ph649 ensures appropriate safeguards are in place, including:

• Contractual clauses that impose data protection obligations on the recipient consistent with Republic Act No. 10173;
• Binding corporate rules where applicable; or
• Such other mechanisms as may be approved by the NPC.

ph649 will not transfer personal data internationally in a manner that is inconsistent with the requirements of the Philippine Data Privacy Act of 2012 without appropriate safeguards in place.

ph649 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with ph649's data destruction procedures.

ph649 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and ph649 servers is protected by 256-bit TLS/SSL encryption.
• Encryption at rest: Sensitive personal data stored in ph649 databases is encrypted using industry-standard AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised ph649 personnel and service providers on a need-to-know basis. All access is logged and subject to regular audit.
• Password security: User passwords are stored as one-way cryptographic hashes using bcrypt. Plain-text passwords are never stored or transmitted by ph649.
• Two-factor authentication: Optional two-factor authentication is available for all ph649 accounts and is strongly recommended.
• Penetration testing: ph649's infrastructure is subject to regular independent security assessments and penetration testing.
• Incident response: ph649 maintains a documented data breach response procedure. In the event of a personal data breach, ph649 will notify the NPC and affected data subjects within the timeframes prescribed by Republic Act No. 10173 where the breach poses a real risk of serious harm.

ph649 uses cookies and similar tracking technologies to operate the Platform, improve user experience, and conduct analytics. Cookies are small text files stored on your device when you visit ph649.

Essential cookies are necessary for the Platform to function and cannot be disabled. Analytics and preference cookies can be controlled through your browser settings. Disabling non-essential cookies will not affect your ability to log in or play games on ph649.

As a data subject under the Philippine Data Privacy Act of 2012, you may exercise your rights at any time by submitting a written request to the ph649 Data Protection Officer at the contact details provided in Section 15.

Your request should include: your full name as registered on your ph649 Account; your registered email address; a clear description of the right you wish to exercise; and supporting documentation where required (e.g., proof of identity for access or deletion requests).

ph649 will acknowledge receipt of your request within five (5) business days and will provide a substantive response within thirty (30) calendar days of receipt. In cases of complexity or high volume of requests, ph649 may extend this period by an additional thirty (30) days, with written notice to you stating the reason for the extension.

If you are dissatisfied with ph649's response to a rights request, you have the right to file a complaint with the National Privacy Commission of the Philippines.

If you are a parent or guardian and believe that a person under the age of 21 in your care has provided personal data to ph649, please contact the ph649 Data Protection Officer immediately at [email protected]. ph649 will investigate promptly and take appropriate action.

ph649 may update this Privacy Policy from time to time to reflect changes in applicable law, NPC guidance, PAGCOR regulatory requirements, or ph649's data processing practices. Material changes will be communicated to registered Players by email to the address associated with their Account and/or through a prominent notice on the Platform, at least fourteen (14) days before the changes take effect.

The "Effective Date" at the top of this Policy indicates when the current version entered into force. Your continued use of ph649 following the effective date of an updated Privacy Policy constitutes acceptance of the revised Policy. If you do not accept the updated Privacy Policy, you may request closure of your Account by contacting ph649 support.

For all privacy-related enquiries, data subject rights requests, or to report a suspected data breach, please contact the ph649 Data Protection Officer through the following channels:

Unresolved privacy complaints may be escalated to the National Privacy Commission of the Philippines. Information on filing a complaint with the NPC is available on the NPC's official government website.