phji Privacy Policy

1. Introduction & Scope

Welcome to phji. This Privacy Policy ("Policy") describes how phji ("we", "our", or "us") collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "your", or "the Player") who access or use the phji online gaming platform available at phji.app (the "Platform").

This Policy applies to all personal data processed in connection with:

• Registration and maintenance of a phji player account.
• Deposits, withdrawals, and all financial transactions conducted through the Platform.
• Participation in any game, sport, live casino event, bingo, or slot product offered on the Platform.
• Communications between you and phji's customer support, compliance, or marketing teams.
• Your general browsing and use of the phji website and any associated mobile applications.

This Policy should be read together with phji's Terms & Conditions and Responsible Gaming Policy. By registering an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please discontinue your use of the Platform immediately.

2. Data Controller Identity

For the purposes of the Data Privacy Act of 2012 and all applicable data protection legislation, the data controller responsible for your personal data is:

phji has appointed a Data Protection Officer (DPO) in accordance with the requirements of the National Privacy Commission. If you wish to exercise any of your data subject rights described in Section 9 of this Policy, or if you have any query regarding phji's data processing activities, please direct your correspondence to the DPO contact details provided in Section 13.

3. Personal Data We Collect

phji collects personal data from you directly (e.g., information you provide during registration), automatically (e.g., technical data generated by your use of the Platform), and from third-party sources (e.g., identity verification providers). The categories of personal data we collect include:

3.1 Identity & Registration Data

• Full legal name as it appears on your government-issued Philippine ID.
• Date of birth (used to verify 21+ age eligibility in accordance with PAGCOR requirements).
• Nationality and country of residence.
• Username and hashed password.
• Government-issued ID type and number (e.g., PhilSys National ID, UMID card, driver's licence, or passport) submitted during KYC verification.

3.2 Contact Data

• Email address.
• Mobile number (used for OTP authentication and account security alerts).
• Residential address (for KYC and AML compliance purposes).

3.3 Financial Data

• GCash mobile number or PayMaya account reference.
• Bank account details (BPI, BDO, Metrobank) where used for withdrawals.
• Masked card details (last four digits and card type) for Visa and Mastercard transactions.
• Transaction history, including deposit amounts, withdrawal requests, and bonus redemption records — all denominated in Philippine Peso (₱ PHP).

3.4 Gaming & Behavioural Data

• Game session logs, bet history, game outcomes, and wagering patterns.
• Responsible gaming settings, including deposit limits, cooling-off periods, and self-exclusion status.
• Player preferences, favourite games, and promotional offer interactions.

3.5 Technical & Device Data

• IP address and approximate geolocation (country/city level only).
• Device type, operating system, and browser version.
• Session timestamps and login history.
• Cookie identifiers and similar tracking data (see Section 7).

3.6 Communications Data

• Content of support tickets, live chat transcripts, and email correspondence with phji's support team.
• Survey responses and feedback submitted voluntarily by you.

4. How We Use Your Personal Data

phji uses the personal data described in Section 3 for the following purposes:

phji will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required by law, obtaining your explicit consent.

5. Legal Basis for Processing

phji processes your personal data on the following legal grounds as recognised under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to enter into and perform the contract established between you and phji by the Terms & Conditions — including account registration, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing obligations, the Anti-Money Laundering Act, and National Privacy Commission regulations.
• Legitimate interests: Processing necessary for phji's legitimate business interests, including platform security, fraud prevention, responsible gaming monitoring, and anonymised analytics — provided those interests are not overridden by your data protection rights.
• Consent: Where phji relies on your consent as the legal basis (e.g., for non-essential marketing communications), you have the right to withdraw that consent at any time by updating your communication preferences in your account dashboard or by contacting [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

6. Sharing Your Personal Data

phji does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard — to process deposits and withdrawals.
• KYC and identity verification providers: Third-party services used to verify your identity and age in compliance with PAGCOR and AML requirements.
• Game software providers: Licensed third-party game studios whose casino, slot, live dealer, and sports betting products are integrated into the phji platform. These providers may receive anonymised session identifiers necessary to deliver game content.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and Philippine law enforcement agencies — where phji is required by law to disclose personal data.
• Fraud prevention and security services: Third-party risk and fraud detection platforms that assist phji in identifying suspicious activity.
• IT infrastructure and hosting providers: Cloud hosting and data centre partners that store phji platform data under strict data processing agreements.

All third parties with whom phji shares personal data are required to process that data only for the specified purpose, to maintain appropriate technical and organisational security measures, and to comply with the Data Privacy Act of 2012.

7. Cookies & Tracking Technologies

phji uses cookies and similar technologies (collectively, "cookies") on the Platform. A cookie is a small text file placed on your device that allows the Platform to recognise your browser and remember certain information about your session.

7.1 Types of Cookies We Use

7.2 Managing Cookies

You may disable non-essential cookies at any time through your browser's privacy settings. Please note that disabling strictly necessary cookies may impair your ability to log in to or use certain features of the phji Platform. phji does not use any third-party advertising or social media tracking cookies.

8. Data Retention

phji retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to the following retention guidelines:

• Active player accounts: Personal data is retained for the duration of your registration as a phji player.
• Closed accounts: Following account closure, phji retains identity and financial records for a minimum of five (5) years to comply with PAGCOR licensing requirements, the Anti-Money Laundering Act, and the Bureau of Internal Revenue (BIR) record-keeping obligations applicable in the Philippines.
• KYC documents: Identity verification documents are retained for five (5) years from the date of submission, or from the date of account closure, whichever is later.
• Transaction records: Financial transaction histories are retained for a minimum of five (5) years in line with AMLC reporting requirements.
• Support communications: Customer support records are retained for three (3) years from the date of last interaction, unless a longer retention period is required to resolve an ongoing dispute or regulatory inquiry.
• Anonymised analytics data: Anonymised and aggregated usage data that cannot be linked back to any individual may be retained indefinitely for platform improvement purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised using methods that prevent reconstruction of the original data.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012 and applicable NPC regulations, you have the following rights with respect to your personal data held by phji:

• Right to be Informed: You have the right to be informed of the existence of processing of your personal data, including the identity of phji as data controller, the purposes of processing, and any third parties to whom data may be disclosed. This Policy fulfils that obligation.
• Right of Access: You may request a copy of the personal data phji holds about you, together with information about how it is being processed.
• Right to Rectification: You have the right to have any inaccurate or incomplete personal data corrected promptly. You may update basic account information directly in your phji account dashboard. For KYC-related corrections, please contact our support team.
• Right to Erasure: Subject to applicable legal and regulatory obligations, you may request the deletion of your personal data. Please note that phji is required to retain certain records for the mandatory retention periods described in Section 8, and erasure requests cannot override those obligations.
• Right to Object: You may object to the processing of your personal data where phji relies on legitimate interests as the legal basis, particularly with regard to direct marketing communications. You may opt out of marketing communications at any time via your account dashboard.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller where technically feasible.
• Right to File a Complaint: If you believe phji has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission of the Philippines.

To exercise any of the above rights, please submit a written request to phji's Data Protection Officer at [email protected]. phji will acknowledge your request within five (5) business days and endeavour to provide a substantive response within fifteen (15) business days, extendable by a further fifteen (15) business days in complex cases upon notice to you.

10. Security Measures

phji implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Encryption: All data transmitted between your device and phji servers is encrypted using TLS 1.2 or higher. Stored personal and financial data is protected using AES-256 encryption at rest.
• Access controls: Access to systems containing personal data is restricted to authorised phji personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all internal system access.
• Intrusion detection: phji operates continuous network monitoring and intrusion detection systems to identify and respond to security threats in real time.
• Penetration testing: phji conducts regular independent security assessments and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: In the event of a personal data breach that poses a real risk to your rights and freedoms, phji will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, and will inform affected players without undue delay as required by NPC Circular No. 16-03.
• Staff training: All phji employees and contractors with access to personal data receive regular data privacy and security training.

While phji takes all reasonable steps to protect your personal data, no transmission over the internet or electronic storage system is completely secure. You are responsible for maintaining the security of your phji account credentials. If you suspect any unauthorised access to your account, contact us immediately at [email protected].

11. Children & Minors

The phji Platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR minimum age requirements for casino-style gaming in the Philippines. phji does not knowingly collect personal data from individuals under the age of 21.

All registration submissions are subject to date-of-birth verification and KYC identity checks. Where phji discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account permanently closed. Any funds deposited by an underage player will be returned to the source payment method, less any amounts required to be retained for regulatory reporting purposes.

If you are a parent or guardian and believe that your child under the age of 21 has registered a phji account, please contact us immediately at [email protected] so we can take prompt action.

12. Changes to This Privacy Policy

phji reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC regulations, or PAGCOR licensing requirements. All revisions will be posted on this page with an updated "Last Updated" date at the top of the Policy.

Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — phji will provide prominent notice on the Platform and, where practicable, notify you by email to the address registered on your phji account, at least fourteen (14) days before the changes take effect.

Your continued use of the phji Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you may close your account in accordance with Section 12 of the Terms & Conditions.

13. Contact & Data Protection Officer Details

If you have any questions, concerns, or requests relating to this Privacy Policy or phji's handling of your personal data, you are welcome to contact us through the following channels:

• Data Protection Officer (DPO) Email: [email protected]
• General Support: Available 24/7 via Live Chat on the phji Platform after login.
• Response Time: DPO enquiries are acknowledged within five (5) business days and substantively responded to within fifteen (15) business days.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe phji has not adequately addressed your data privacy concerns:

phji takes all privacy complaints seriously and will cooperate fully with the National Privacy Commission in the investigation of any complaint filed against us.