phtayah Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how phtayah ("we," "us," "our," "the Platform") collects, uses, stores, shares, and protects personal data relating to registered players, prospective players, and visitors to phtayah.net and its associated applications (collectively, "the phtayah Platform").

phtayah is committed to handling all personal data responsibly, transparently, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and any other applicable data protection legislation that governs the processing of personal data of Filipino residents.

This Policy applies to all personal data collected through the phtayah website, mobile applications, account registration forms, customer support interactions, KYC verification processes, and payment transactions. By registering for a phtayah account or by continuing to use the phtayah Platform after this Policy has been updated, you acknowledge that you have read, understood, and consented to the practices described herein.

If you do not agree with any provision of this Privacy Policy, you must discontinue use of the phtayah Platform and may request account closure through our 24/7 support channel.

2 Data We Collect

phtayah collects personal data through several distinct channels, including the account registration process, ongoing platform use, identity verification procedures, payment transactions, and customer support interactions. The categories of personal data we collect include:

3 How We Use Your Data

phtayah uses the personal data we collect for the following specific purposes. We do not use your data for any purpose beyond what is described in this Policy without first obtaining your explicit consent.

• Account Registration and Management: To create and manage your phtayah player account, verify your identity during the registration process, and maintain the accuracy of your account information over time.
• Age and Identity Verification: To confirm that all registered players meet the minimum age requirement of 21 years under applicable Philippine regulatory frameworks, and to prevent fraudulent account creation.
• Payment Processing: To facilitate deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, and other supported Philippine payment channels. Financial data is shared with payment processors solely for transaction execution purposes.
• Regulatory Compliance and AML: To fulfill phtayah's obligations under applicable Philippine anti-money laundering (AML) regulations, including transaction monitoring, suspicious activity reporting, and record-keeping requirements.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent unauthorized account access, fraudulent activity, bonus abuse, multi-accounting, and other security threats to the phtayah Platform and its players.
• Responsible Gaming: To monitor player activity patterns for indicators of problem gambling, enforce deposit limits and self-exclusion restrictions, and proactively reach out to players who may be exhibiting signs of harmful gaming behavior.
• Customer Support: To process and respond to support requests, resolve disputes, investigate complaints, and improve the overall quality of the phtayah support experience.
• Platform Improvement: To analyze aggregated usage data in order to identify performance issues, improve game offerings, optimize the user interface, and enhance the phtayah platform experience for Filipino players.
• Legal Compliance: To comply with any applicable court orders, regulatory directives, legal processes, or lawful requests from Philippine government authorities.

4 Legal Basis for Processing

phtayah processes your personal data on the following legal bases as recognized under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Contractual Necessity: The processing of your identity data, contact data, and financial data is necessary for the performance of the player agreement (as set out in phtayah's Terms and Conditions) between you and phtayah. Without this data, phtayah cannot create your account, process your transactions, or deliver the gaming services you have registered to use.
• Consent: Where phtayah processes your personal data for purposes beyond contractual necessity — such as sending optional promotional notifications or processing optional preference data — we rely on your explicit, informed consent. You may withdraw this consent at any time through your account settings or by contacting phtayah support.
• Legal Obligation: phtayah is required by applicable Philippine law to collect, retain, and in certain circumstances disclose specific categories of personal data. This includes AML-related record-keeping obligations, age verification requirements, and responses to lawful orders from Philippine regulatory or law enforcement authorities.
• Legitimate Interests: phtayah may process certain technical and usage data on the basis of its legitimate interests in maintaining platform security, preventing fraud, and improving its services — provided those interests are not overridden by your rights and interests as a data subject.

5 Data Sharing and Disclosure

phtayah does not sell, rent, or trade your personal data to any third party. However, phtayah may share specific categories of your personal data with the following types of third parties, strictly on a need-to-know basis and only to the extent necessary for the stated purpose:

• Payment Service Providers: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and other payment partners receive the minimum financial data required to process your deposit and withdrawal transactions. These providers operate under their own privacy policies and are bound by Philippine financial data protection regulations.
• Identity Verification Partners: Third-party KYC and identity verification service providers may process your identification documents and biometric verification data to confirm your eligibility to use the phtayah Platform. All such partners are contractually bound to process your data solely for verification purposes.
• Game Content Providers: Where games on the phtayah Platform are provided by third-party game studios or live dealer operators, limited session and wagering data may be shared with those providers to facilitate gameplay and resolve disputes. Game providers do not receive your full identity or financial profile.
• Fraud Prevention Services: Aggregated technical data including IP addresses and device fingerprints may be shared with fraud detection service providers to identify and prevent multi-accounting, bonus abuse, and unauthorized account access.
• Philippine Regulatory Authorities: phtayah may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other relevant Philippine authorities where required by law, court order, or regulatory directive. phtayah will not provide more data than is strictly required by the applicable legal obligation.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by phtayah may access personal data on a confidential basis where necessary for the provision of their professional services to phtayah.

6 Payment Data and KYC

phtayah is required under applicable Philippine regulations to conduct Know Your Customer (KYC) verification for all registered players, particularly before processing withdrawals above specified thresholds. This process requires the collection and verification of identity documents and, in some cases, proof of source of funds.

phtayah does not store raw payment card data on its own servers. All payment card processing, where applicable, is handled by PCI-DSS compliant payment processors. For e-wallet transactions via GCash, Maya, and GrabPay, only the account holder's registered mobile number and transaction reference data are retained by phtayah — the underlying wallet credentials are never stored by phtayah.

• KYC documents submitted to phtayah are stored in encrypted form on secured servers with strict access controls limited to authorized compliance personnel.
• KYC documents are retained for the period required by applicable Philippine AML regulations, which is a minimum of five (5) years from the date of account closure or the last transaction on the account, whichever is later.
• Players who have not completed KYC verification may be subject to withdrawal restrictions until the verification process is satisfactorily completed.
• phtayah reserves the right to request updated or additional KYC documentation at any time where there is a material change in the player's profile or where regulatory obligations require re-verification.

7 Cookies and Tracking Technologies

phtayah uses cookies and similar tracking technologies on the phtayah website and platform. Cookies are small text files placed on your device that allow phtayah to recognize your browser, remember your preferences, maintain your session security, and analyze how the platform is used.

• Strictly Necessary Cookies: These cookies are essential for the phtayah platform to function. They maintain your login session, protect against cross-site request forgery, and ensure the security of your account. These cookies cannot be disabled.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming tool configurations — so you do not have to re-enter them on each visit.
• Analytics Cookies: phtayah uses aggregated, anonymized analytics data to understand how players navigate the platform, which games are most popular, and where technical issues may be occurring. This data does not identify you personally.
• Security Cookies: Certain cookies support phtayah's fraud detection and bot prevention systems, helping to distinguish between legitimate human players and automated scripts attempting to access the platform.

You may configure your browser to block or delete cookies; however, please note that disabling strictly necessary cookies will impair your ability to log in to and use the phtayah platform. phtayah does not use third-party advertising cookies or cross-site behavioral tracking technologies.

8 Data Retention

phtayah retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention guidelines apply:

• Active Account Data: Personal data associated with an active phtayah account is retained for the full duration that the account remains active and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements under Philippine law.
• Transaction Records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of five (5) years from the date of each transaction, as required by Philippine AML regulations.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years following account closure or the last transaction date, whichever is later.
• Customer Support Communications: Live chat transcripts, support tickets, and email correspondence are retained for a minimum of two (2) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical Logs: Server and access logs containing IP addresses and session data are retained for a maximum of twelve (12) months unless they form part of an ongoing security investigation.
• Self-Excluded Player Records: Records of self-excluded players are retained for the full duration of the exclusion period plus five (5) years, to prevent re-registration in breach of the exclusion order.

Upon expiry of the applicable retention period, phtayah will securely delete or anonymize personal data in a manner that ensures it cannot be reconstructed or re-identified.

9 Data Security

phtayah implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phtayah platform.
• Encryption at rest for all sensitive personal data and KYC documents stored on phtayah servers.
• Multi-factor authentication options for player accounts to prevent unauthorized access.
• Role-based access controls limiting internal access to personal data strictly to personnel with a legitimate operational need.
• Regular penetration testing and vulnerability assessments of the phtayah platform and supporting infrastructure.
• Comprehensive audit logging of all internal access to personal data, with regular review by the phtayah compliance team.
• Incident response procedures for data breaches, including notification to the Philippine National Privacy Commission and affected players within the timeframes required by law.

10 Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, registered phtayah players have the following rights with respect to their personal data held by phtayah. To exercise any of these rights, contact phtayah support via the live chat channel available 24/7 in your account dashboard, or by email at [email protected].

• Right to Be Informed: You have the right to be informed about how your personal data is collected, used, and shared. This Privacy Policy fulfills that obligation. If you have further questions about specific data processing activities, you may contact phtayah support at any time.
• Right to Access: You have the right to request a copy of the personal data that phtayah holds about you. phtayah will respond to verified access requests within thirty (30) calendar days.
• Right to Correction: You have the right to request the correction of any inaccurate or incomplete personal data held by phtayah. Basic profile information — such as your contact number or email address — may be updated directly within your phtayah account settings. Changes to identity data require verification and must be submitted through phtayah support.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. This right is subject to phtayah's legal retention obligations under Philippine AML and gaming regulations, which may require certain data to be retained regardless of an erasure request.
• Right to Object: You have the right to object to the processing of your personal data where phtayah relies on legitimate interests as the legal basis for processing. phtayah will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another data controller where technically feasible.
• Right to Lodge a Complaint: If you believe phtayah has not handled your personal data in accordance with the Philippine Data Privacy Act, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC).

11 Children and Minors

The phtayah platform is strictly intended for adults aged 21 years and above. phtayah does not knowingly collect, process, or retain personal data of individuals under the age of 21. The minimum age restriction of 21 years applies under applicable Philippine regulatory frameworks governing online casino-style gaming.

If phtayah discovers or is notified that an account has been registered by an individual under the age of 21, the account will be immediately suspended and all personal data associated with that account will be deleted from phtayah's systems as promptly as practicable, except to the extent that retention is required by applicable law for fraud investigation or regulatory reporting purposes.

If you are a parent or guardian and you believe that your child has created a phtayah account without your knowledge, please contact phtayah support immediately via live chat so that the account can be investigated and closed without delay.

12 Changes to This Privacy Policy

phtayah may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or platform data practices. All updates to this Policy will be published on the phtayah website at phtayah.net/privacy-policy, with the "Last Updated" date at the top of the Policy revised accordingly.

Where changes to this Policy are material — meaning they significantly affect how phtayah processes your personal data or alter your rights as a data subject — phtayah will provide prior notice to registered players through in-account notifications. For non-material updates, such as clarifications or formatting changes that do not affect the substance of phtayah's data practices, publication on the website constitutes sufficient notice.

Continued use of the phtayah platform after a revised Privacy Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any changes to this Policy, you must stop using the phtayah platform and may request account closure through our support team.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or phtayah's handling of your personal data, you are encouraged to contact our support team through the live chat feature available 24/7 within your phtayah account dashboard. Our support team handles all data-related inquiries with priority.

For formal written correspondence regarding data privacy matters, including data subject rights requests, you may contact phtayah by email. The phtayah data privacy support email is: [email protected]. Please note this is plain text only — it is not a clickable link. Type this address directly into your email client.

phtayah aims to acknowledge all formal data privacy inquiries within two (2) business days and to resolve them within thirty (30) calendar days of receiving all necessary information. Where a matter cannot be resolved directly, you retain the right to escalate your complaint to the Philippine National Privacy Commission.