ph25 Privacy Policy

1. Who We Are

This Privacy Policy is issued by ph25 ("ph25," "we," "us," or "our"), the operator of the online gaming platform accessible at ph25.win. ph25 is the data controller responsible for the personal data of players and visitors collected through the ph25 website and all associated services. ph25 operates in compliance with applicable PAGCOR regulatory requirements and the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines, and its Implementing Rules and Regulations.

For questions, data requests, or privacy concerns, contact our Data Protection Officer at: [email protected] (subject line: Privacy / DPO Request).

2. Data We Collect

ph25 collects personal data that is necessary to provide gaming services, comply with regulatory obligations, and protect the security of our platform. The categories of data we collect include:

• Identity Data: Full legal name, date of birth, nationality, government-issued ID number and copies (UMID, Driver's License, Passport, PhilSys ID, SSS/GSIS, or Voter's ID);
• Contact Data: Philippine mobile number (Globe, Smart, DITO, or Sun), email address, and residential address;
• Financial Data: GCash account number, PayMaya details, bank account information (BPI, BDO, Metrobank), transaction history, deposit and withdrawal records;
• Account Data: Username, password (hashed), login history, session timestamps, and security settings;
• Gameplay Data: Game participation records, betting history, wagering activity, bonus usage, and win/loss records;
• Technical Data: IP address, device type, browser type and version, operating system, screen resolution, and geolocation data;
• Usage Data: Pages visited, features used, time spent on platform, click patterns, and navigation paths;
• Communications Data: Support chat logs, email correspondence, and any other communications with ph25 staff.

ph25 does not collect sensitive personal information (as defined under RA 10173) beyond what is strictly required for identity verification and regulatory compliance purposes.

3. How We Use Your Data

ph25 uses the personal data we collect for the following purposes:

• Account Management: To create and maintain your ph25 account, verify your identity, process KYC documentation, and authenticate your login;
• Service Delivery: To process deposits and withdrawals, deliver gaming services, credit bonuses, and manage your PHP wallet balance;
• Regulatory Compliance: To meet our obligations under PAGCOR regulations, Philippine Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012;
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, bonus abuse, and other prohibited conduct;
• Responsible Gaming: To monitor gaming patterns that may indicate problem gambling and to enforce responsible gaming tools including deposit limits and self-exclusion;
• Customer Support: To respond to your inquiries, resolve disputes, and communicate important account-related information;
• Platform Improvement: To analyze usage patterns, test new features, and improve the ph25 user experience for Filipino players;
• Marketing (with consent): To send promotional offers, bonus notifications, and platform updates where you have opted in. You may withdraw marketing consent at any time through your account settings.

4. Legal Basis for Processing

ph25 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contract Performance: Processing necessary to fulfill the ph25 Terms & Conditions you accepted upon registration — including account management, payment processing, and game delivery;
• Legal Obligation: Processing required to comply with PAGCOR regulations, AMLA obligations, tax reporting requirements, and court or regulatory orders;
• Legitimate Interest: Processing for fraud detection, platform security, responsible gaming monitoring, and internal analytics, where these interests are not overridden by your privacy rights;
• Consent: Processing for direct marketing communications, where you have provided explicit opt-in consent. This consent may be withdrawn at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

ph25 does not sell your personal data. We may share your data with the following categories of third parties, strictly for the purposes described in this Policy:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya, BPI, BDO, Metrobank — for the purpose of processing deposits and withdrawals;
• Game Providers: Licensed game developers and live casino providers who supply content to the ph25 platform, limited to data required for game session management;
• KYC / Identity Verification Providers: Third-party services that assist in verifying government-issued identification documents;
• IT & Hosting Providers: Cloud infrastructure and data hosting partners who process data on our behalf under strict data processing agreements;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies, when required by law or legal process;
• Professional Advisors: Lawyers, auditors, and compliance consultants, under confidentiality obligations.

All third-party processors engaged by ph25 are contractually bound to process personal data only under our documented instructions and to maintain appropriate technical and organizational security measures.

6. Cookies & Tracking Technologies

ph25 uses cookies and similar tracking technologies to operate the platform and analyze usage. The categories of cookies we use include:

• Strictly Necessary Cookies: Required for platform functionality, including session management, authentication, and security. These cannot be disabled;
• Analytics Cookies: Used to understand how players navigate ph25, which features are used most, and where technical issues may occur — solely for platform improvement purposes;
• Preference Cookies: Remember your language, display preferences, and account settings between sessions.

ph25 does not use third-party advertising or tracking cookies. You may configure cookie preferences through your browser settings, though disabling strictly necessary cookies will impair platform functionality.

7. Data Retention

ph25 retains personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following minimum retention periods:

• Active Account Data: Retained for the duration of your account's active status plus five (5) years following account closure, in compliance with PAGCOR and AMLA record-keeping requirements;
• Financial Transaction Records: Retained for a minimum of ten (10) years from the date of the transaction, as required by the Anti-Money Laundering Act;
• KYC Documentation: Retained for five (5) years following account closure or the conclusion of any related regulatory investigation, whichever is later;
• Support Communications: Retained for three (3) years from the date of the last communication.

Upon expiry of the applicable retention period, ph25 will securely delete or anonymize your personal data in accordance with our data destruction procedures.

8. Data Security

ph25 implements technical and organizational measures designed to protect your personal data against unauthorized access, loss, alteration, or disclosure. These measures include:

• TLS 1.3 encryption for all data in transit between your device and ph25 servers;
• AES-256 encryption for sensitive data at rest;
• Bcrypt hashing for all stored passwords — ph25 staff cannot view your password in plaintext;
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Multi-factor authentication requirements for platform administrative access.

While ph25 maintains robust security practices, no internet transmission or digital storage system is completely impenetrable. In the event of a personal data breach that poses a real risk of serious harm, ph25 will notify affected players and the National Privacy Commission within seventy-two (72) hours of discovery, as required by NPC regulations.

9. Your Rights Under Philippine Data Privacy Law

Under the Data Privacy Act of 2012 and its Implementing Rules, you have the following rights with respect to your personal data held by ph25:

• Right to be Informed: To know what personal data ph25 collects and how it is processed;
• Right of Access: To request a copy of the personal data ph25 holds about you;
• Right to Rectification: To have inaccurate or incomplete personal data corrected;
• Right to Erasure / Blocking: To request deletion or blocking of your personal data where processing is no longer necessary or where consent has been withdrawn, subject to legal retention obligations;
• Right to Object: To object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation;
• Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format;
• Right to Lodge a Complaint: To file a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of these rights, submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Rights Request." ph25 will respond within fifteen (15) business days of receiving a verifiable request.

10. Children & Minors

The ph25 platform is strictly for adults aged 21 years and above, in compliance with PAGCOR regulations governing online gaming in the Philippines. ph25 does not knowingly collect personal data from any person under the age of 21. If ph25 discovers that a minor has registered an account, the account will be immediately closed, all associated data will be deleted, and any deposited funds will be returned to the source payment method.

If you believe that a minor has registered on the ph25 platform, please contact us immediately at [email protected].

11. Cross-Border Data Transfers

ph25 primarily processes and stores data within infrastructure serving the Philippine market. In limited circumstances — such as engaging international game providers or IT infrastructure partners — personal data may be transferred outside the Philippines. All such transfers are conducted under data transfer agreements that ensure the receiving party provides a level of data protection equivalent to or exceeding the standards of the Data Privacy Act of 2012. ph25 does not transfer personal data to jurisdictions that do not provide adequate data protection safeguards.

12. Changes to This Policy

ph25 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. Material changes will be communicated to registered members via email or in-platform notification at least seven (7) days before the changes take effect. The "Last updated" date at the top of this page will be revised with each update. The current version of this Policy is always accessible at ph25.win/privacy-policy. Continued use of the ph25 platform after the effective date of any revision constitutes acknowledgment of the updated Policy.

13. Contact & Data Protection Officer

ph25 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. For privacy inquiries, data rights requests, or to report a potential data protection concern, please contact: