ph367 Privacy Policy

1.1 ph367 is committed to protecting the privacy and personal data of all Filipino players who use the Platform. This commitment is grounded in the requirements of Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("Data Privacy Act"), and the implementing rules and regulations issued by the National Privacy Commission ("NPC").

1.2 This Policy explains, in plain language where possible:

• What categories of personal data ph367 collects;
• How and why that data is collected;
• The lawful basis for ph367's data processing activities;
• With whom ph367 may share personal data, and under what conditions;
• How long ph367 retains personal data;
• The technical and organisational measures ph367 uses to protect personal data; and
• The rights available to Filipino players under RA 10173 and how to exercise them.

1.3 This Policy should be read together with the ph367 Terms and Conditions, which are incorporated herein by reference and govern the overall relationship between ph367 and its Players.

2.1 For the purposes of the Philippine Data Privacy Act and this Policy, ph367 acts as the Personal Information Controller ("PIC") in respect of the personal data collected and processed through the Platform. As PIC, ph367 determines the purposes and means of processing personal data relating to Players and Platform visitors.

2.2 ph367 operates ph367.win as an online casino and sports betting platform targeting Filipino players in the Philippines, under the regulatory oversight of the Philippine Amusement and Gaming Corporation ("PAGCOR").

2.3 ph367 has designated a Data Protection Officer ("DPO") as required under RA 10173 and the NPC's implementing rules. The DPO is responsible for overseeing ph367's compliance with data privacy obligations and for handling data subject inquiries and complaints. Contact details for the DPO are provided in Section 14 of this Policy.

3.1 ph367 collects only the personal data that is necessary for the lawful and proper operation of the Platform. The following table sets out the categories of personal data ph367 collects and the primary context in which each category is obtained:

3.2 ph367 does not intentionally collect sensitive personal information (as defined under Section 3(l) of RA 10173) beyond what is strictly required for KYC compliance purposes. Where government-issued ID data is collected, it is used solely for identity verification and retained only for as long as legally required.

4.1 ph367 collects personal data through the following channels and mechanisms:

• Direct collection: Data you provide directly to ph367 when registering an Account, completing KYC verification, contacting support, or responding to promotions;
• Automated collection: Technical and usage data collected automatically when you access the Platform, including IP addresses, device identifiers, session data, and cookies (see Section 9);
• Payment processors: Transaction confirmation data shared by GCash, Maya, BDO, BPI, Metrobank, UnionBank, and other payment partners when you conduct a deposit or withdrawal;
• Third-party identity verification providers: Document and identity data from accredited KYC verification partners used to confirm the authenticity of government-issued IDs submitted by Players;
• Regulatory sources: Information received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine government agencies in the context of regulatory compliance obligations.

5.1 ph367 processes personal data only where there is a clear lawful basis for doing so under the Data Privacy Act. The table below summarises ph367's primary processing purposes and their corresponding lawful bases:

5.2 Where ph367 relies on legitimate interest as a lawful basis for processing, ph367 has assessed that its legitimate interests are not overridden by the data subject's rights and interests, having regard to the reasonable expectations of Players who are registered users of a regulated gaming platform.

6.1 ph367 does not sell, rent, or trade personal data to third-party commercial marketers. Personal data is shared externally only in the specific circumstances described below:

• PAGCOR and Philippine regulatory authorities: ph367 is required by law to share player data with PAGCOR and, where applicable, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and other Philippine government agencies in the performance of their regulatory and law enforcement functions;
• Payment processing partners: Financial data necessary to process deposits and withdrawals is shared with ph367's payment partners (including GCash, Maya, BPI, BDO, Metrobank, UnionBank, and others) solely to execute the relevant transaction;
• KYC and identity verification providers: Identity documents and data are shared with accredited third-party verification service providers to authenticate government-issued IDs submitted by Players during the KYC process;
• Game content providers: Limited technical and gameplay data is shared with ph367's game content providers (such as JILI Games, PG Soft, and Pragmatic Play) to operate their games on the Platform, under data processing agreements;
• Security and fraud prevention providers: Technical and behavioural data may be shared with third-party security providers engaged to detect and prevent fraud, multi-accounting, and other prohibited conduct;
• Legal and professional advisers: Personal data may be disclosed to ph367's legal counsel, auditors, or other professional advisers on a strictly need-to-know basis in connection with specific legal or compliance matters;
• Business transfers: In the event of a merger, acquisition, or transfer of ph367's business or assets, personal data held by ph367 may be transferred to the relevant successor entity, subject to equivalent privacy protections.

6.2 All third parties with whom ph367 shares personal data are required, by contract, to process that data in accordance with RA 10173 and ph367's instructions, and to maintain appropriate technical and organisational security measures.

7.1 ph367 retains personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable Philippine law.

7.2 The following general retention principles apply:

• Account data and KYC documentation: Retained for the duration of the Account and for a minimum of five (5) years following Account closure or the date of the last transaction, as required under PAGCOR regulations and RA 9160 (AMLA);
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, in accordance with Philippine anti-money laundering record-keeping requirements;
• Gaming activity logs: Retained for a minimum of two (2) years from the date of the relevant gaming session, for responsible gaming monitoring and dispute resolution purposes;
• Support communications: Retained for a minimum of two (2) years from the date of the communication, for quality assurance and dispute resolution purposes;
• Technical and usage data: Retained for up to twelve (12) months from the date of collection, unless required to be retained longer for security or fraud investigation purposes.

7.3 Upon the expiry of applicable retention periods, ph367 will securely delete or anonymise personal data such that it can no longer be attributed to an identifiable individual.

8.1 ph367 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between Players' devices and ph367's servers;
• Encryption of sensitive stored data, including government ID images, payment credentials, and passwords;
• Role-based access controls limiting ph367 employee access to personal data to those with a legitimate operational need;
• Two-factor authentication (2FA) options available to all Players for Account access;
• Regular security assessments, penetration testing, and vulnerability scanning of the Platform;
• Segregated storage of different data categories with differential access controls;
• Incident response procedures enabling ph367 to detect, assess, and respond to data breaches in a timely manner.

8.2 In the event of a personal data breach that is likely to result in serious harm to affected data subjects, ph367 will notify the National Privacy Commission and affected Players as required under Section 20(f) of RA 10173 and the NPC's Circular on Personal Data Breach Management.

8.3 Notwithstanding ph367's security measures, no data transmission over the internet or mobile network can be guaranteed to be 100% secure. Players are advised to take their own precautions, including enabling 2FA on their ph367 Account and keeping their login credentials confidential.

9.1 ph367 uses cookies and similar tracking technologies (collectively "Cookies") on the Platform for the purposes described in this Section. Cookies are small data files stored on your device when you access a website.

9.2 ph367 uses the following categories of Cookies:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including maintaining your login session and remembering your Account preferences. These Cookies cannot be disabled without impairing Platform functionality;
• Security Cookies: Used to support fraud detection and prevention measures, including device fingerprinting for Account security purposes;
• Analytics Cookies: Used to collect anonymised aggregate data about how Players navigate and use the Platform, to enable ph367 to improve the user experience. Analytics data is not linked to individual Player identities in reporting;
• Preference Cookies: Used to remember your language, display, and other Platform preferences to provide a more personalised experience.

9.3 ph367 does not use third-party advertising or behavioural targeting cookies. ph367 does not permit third-party ad networks to set cookies on ph367.win for advertising purposes.

9.4 Players may control Cookie settings through their browser settings. Note that disabling certain categories of Cookies may affect Platform functionality, particularly Strictly Necessary Cookies required for login session management.

10.1 ph367 does not knowingly collect personal data from any person under the age of 21. The ph367 Platform is strictly restricted to individuals who are 21 years of age or older, as required by PAGCOR regulations and applicable Philippine gaming laws.

10.2 As part of the registration and KYC process, ph367 verifies the age of all registering Players. Any Account found to have been registered by a person under 21 will be immediately closed, any funds processed will be handled in accordance with the ph367 Terms and Conditions, and any personal data collected in connection with that Account will be securely deleted, except to the extent that retention is required by applicable law.

10.3 If ph367 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data. If you believe ph367 has collected data from a minor, please contact the ph367 Data Protection Officer using the contact details in Section 14.

11.1 Under the Philippine Data Privacy Act of 2012 (RA 10173), Filipino players have the following rights in respect of their personal data held by ph367. These rights may be exercised by contacting the ph367 Data Protection Officer as described in Section 14:

11.2 ph367 will respond to data subject requests within the timeframes required by the NPC's implementing rules — generally within 15 calendar days of receipt of a complete and verified request. Requests may be subject to identity verification before processing to ensure ph367 does not disclose personal data to an unauthorised party.

12.1 Certain of ph367's service providers — including game content providers such as JILI Games and PG Soft, and technical infrastructure providers — may be located or operate servers outside the Republic of the Philippines. Where personal data is transferred to a jurisdiction outside the Philippines, ph367 ensures that appropriate safeguards are in place to protect the data, including:

• Data processing agreements incorporating data protection obligations aligned with the requirements of RA 10173;
• Transfer to jurisdictions recognised by the NPC as providing an adequate level of data protection; or
• Other transfer mechanisms approved by the NPC under its applicable rules.

12.2 Where cross-border data transfers occur, ph367 notifies the NPC as required and maintains records of all such transfers in accordance with NPC requirements.

13.1 ph367 may update this Privacy Policy from time to time to reflect changes in its data processing activities, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. When material changes are made, ph367 will notify active Players via the mobile number or email address registered to their Account, or via a prominent notice on ph367.win, prior to the changes taking effect.

13.2 The date of the most recent update to this Policy is displayed at the top of this page. Players are encouraged to review this Policy periodically to remain informed of how ph367 protects their personal data.

13.3 Continued use of the ph367 Platform following notification of changes to this Policy constitutes acceptance of the updated Policy.

14.1 For any inquiries, concerns, or requests relating to this Privacy Policy or ph367's data processing activities — including the exercise of your rights under RA 10173 — you may contact ph367's Data Protection Officer through the following channels:

14.2 If you are not satisfied with ph367's response to your data privacy concern, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which is the governmental authority responsible for enforcing RA 10173. Information on lodging a complaint with the NPC is available through official Philippine government resources.

14.3 ph367 takes all data privacy complaints seriously and is committed to resolving concerns in a fair and timely manner in accordance with its obligations under RA 10173 and the NPC's implementing rules and regulations.