phtay Privacy Policy

This Privacy Policy applies to all personal data collected, processed, stored, and disclosed by phtay in connection with the operation of the phtay.one online gaming platform and any related communications, customer support interactions, and promotional activities directed at Filipino players.

phtay acts as the Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012 with respect to the personal data of its registered players. Where phtay engages third-party service providers to process data on its behalf, those providers act as Personal Information Processors (PIPs) and are contractually bound to handle data only as instructed by phtay.

This Policy covers all personal data collected through: the phtay.one website, the phtay mobile web interface, customer support communications (live chat and email), KYC document submission, payment processing interactions, and any marketing or promotional communications you receive from phtay.

• "Personal Data" — any information from which the identity of an individual can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual (per RA 10173).
• "Sensitive Personal Information" — personal data about race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, legal proceedings, and government-issued identifiers.
• "Processing" — any operation performed upon personal data including collection, recording, organization, storage, updating, retrieval, use, disclosure, or destruction.
• "Platform" — the phtay online gaming website accessible at phtay.one.
• "Player" / "you" — any individual who has registered an account on the Platform or is in the process of registering.
• "DPA" — Republic Act No. 10173, the Data Privacy Act of 2012.
• "NPC" — the National Privacy Commission of the Philippines.
• "DPO" — phtay's designated Data Protection Officer.

phtay collects the following categories of personal data:

phtay collects personal data through the following channels:

• Direct Collection: Data you provide directly during account registration, KYC document upload, payment method setup, support chat interactions, and email correspondence.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP addresses, device identifiers, browser fingerprints, session cookies, and login event logs. This data is collected regardless of whether you are logged in.
• Payment Processor Data: Transaction confirmation data returned by GCash, Maya, BPI, BDO, Metrobank, and other payment providers following a deposit or withdrawal. phtay does not store full payment account credentials — only the reference identifiers and transaction metadata required for reconciliation and AMLA reporting.
• Third-Party Verification: Where identity or age verification is conducted using a third-party KYC service, that service may return verification outcomes and risk scoring data to phtay.
• Gaming System Logs: Game servers automatically record all game events, bet placements, spin outcomes, and session data as part of normal platform operation.

phtay uses collected personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your phtay account; processing login and authentication; managing account settings and preferences.
• Identity and Age Verification: Conducting mandatory KYC checks to verify your identity, age (21+), and eligibility to use the Platform under PAGCOR requirements.
• Payment Processing: Executing deposits and withdrawals in Philippine Peso via your registered payment methods; reconciling transaction records; preventing payment fraud.
• Legal and Regulatory Compliance: Meeting obligations under the DPA, AMLA, PAGCOR regulations, and any applicable court orders or regulatory directives. This includes maintaining mandatory transaction records and reporting suspicious activity.
• Platform Operation and Improvement: Delivering games, monitoring platform performance, diagnosing technical issues, and developing new features based on anonymized aggregate usage patterns.
• Responsible Gaming: Monitoring gaming behavior patterns to identify potential problem gambling indicators; administering deposit limits, cooling-off periods, and self-exclusion requests; complying with responsible gaming obligations.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorized account access.
• Customer Support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in. You may withdraw marketing consent at any time via Account Settings or by contacting support.

Under the Data Privacy Act of 2012, phtay processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfill our obligations to you under the phtay Terms and Conditions — including account creation, payment processing, game delivery, and customer support.
• Legal Obligation: Processing required to comply with Philippine law, including AMLA transaction monitoring and reporting, PAGCOR regulatory requirements, court orders, and NPC directives.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and platform improvement where such interests do not override your fundamental privacy rights.
• Consent: Processing for optional marketing communications. Consent is obtained at registration and may be withdrawn at any time without affecting your ability to use the Platform.

phtay does not sell your personal data. We may disclose personal data to the following categories of recipients in specific circumstances:

• Payment Processors: GCash, Maya, BPI, BDO, Metrobank, and other payment providers receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and Philippine BSP regulations.
• KYC and Identity Verification Services: Third-party identity verification providers may receive your identity document data solely for the purpose of KYC verification. They are bound by contractual data processing agreements.
• Game Providers: Game servers operated by third-party providers (JILI, PG Soft, Pragmatic Play, etc.) receive session tokens and bet data necessary to operate game rounds. Game providers do not receive your full identity data.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, and other Philippine regulatory bodies may receive data as required by law, regulation, or lawful order. phtay will notify affected players of such disclosures where legally permitted to do so.
• Law Enforcement: Philippine law enforcement agencies may receive data pursuant to a valid court order, subpoena, or lawful request under applicable Philippine law.
• Professional Advisers: Legal counsel, auditors, and compliance consultants engaged by phtay may access personal data under strict confidentiality obligations where necessary for their professional engagements.

All third-party recipients of personal data are required by phtay to handle such data in accordance with the DPA and applicable data protection standards.

phtay uses cookies and similar technologies to operate the Platform effectively. The following cookie categories are used:

• Strictly Necessary Cookies: Required for core platform functions including authentication session management, security tokens, and fraud prevention. These cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Remember your preferences such as language settings, game lobby display preferences, and account configuration choices. Disabling these may affect your personalized experience.
• Analytics Cookies: Collect anonymized data on how players navigate the Platform — which game categories are visited most, session duration, feature usage — to help phtay improve the player experience. This data is not linked to individual player identities.
• Session Tokens: Short-lived tokens that authenticate your active login session. These expire upon logout or after a period of inactivity.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent Platform login and normal operation. phtay does not use third-party advertising cookies or cross-site behavioral tracking cookies.

phtay retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, subject to applicable legal requirements:

• Account Data: Retained for the duration of your active account plus 5 years following account closure, as required for AMLA compliance and potential dispute resolution.
• KYC Documents: Retained for 5 years from the date of account closure, as required under AMLA and PAGCOR regulations.
• Transaction Records: Retained for 5 years from the date of each transaction, in compliance with AMLA record-keeping requirements.
• Gaming Activity Logs: Retained for 3 years from the date of each gaming session for platform security, responsible gaming monitoring, and dispute resolution purposes.
• Support Communications: Retained for 2 years from the date of each interaction for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of the consent plus 2 years to demonstrate compliance with consent-based processing.

Upon expiry of the applicable retention period, personal data is securely destroyed or anonymized such that it can no longer be associated with an identifiable individual.

phtay implements the following technical and organizational security measures to protect your personal data:

• Encryption in Transit: All data transmitted between your device and phtay servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all Platform interactions including login, payment, and game data.
• Encryption at Rest: Sensitive personal data and KYC documents stored on phtay servers are encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorized phtay personnel whose job roles require such access. Role-based access controls and activity logging are enforced across all internal systems.
• Two-Factor Authentication: Available to all players for account login; mandatory for all phtay internal administrative systems.
• Security Monitoring: phtay operates continuous monitoring for suspicious access patterns, unauthorized login attempts, and anomalous transaction activity.
• Breach Response: In the event of a personal data breach that poses a risk to affected individuals, phtay will notify the NPC within 72 hours of discovery and will notify affected players within a reasonable period, in accordance with DPA breach notification requirements.

While phtay takes extensive precautions, no online system is entirely immune to security incidents. You share responsibility for your account security by maintaining a strong, unique password and enabling two-factor authentication on your phtay account.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phtay:

The phtay Platform is strictly intended for individuals aged 21 years and above. phtay does not knowingly collect personal data from individuals under the age of 21. The minimum age of 21 is enforced through mandatory KYC age verification during the account registration and first-withdrawal process.

If phtay discovers or is notified that a registered account belongs to an individual under 21, that account will be immediately and permanently closed. Any real-money funds deposited by an underage player will be handled in accordance with applicable Philippine law and PAGCOR requirements, which may include forfeiture. phtay will report such incidents to the relevant regulatory authorities where required.

The phtay Platform integrates with third-party services necessary for its operation, including game providers, payment processors, and identity verification services. While phtay selects third-party providers carefully and requires contractual data protection commitments, each third-party provider operates under its own terms and privacy policy with respect to data it independently holds.

phtay is not responsible for the privacy practices of third-party services that you access independently of the Platform (such as GCash or Maya apps on your device). The phtay.one website does not contain links to external third-party websites. Any content or services accessible through the Platform are integrated directly and are governed by the applicable provider agreements phtay has in place.

Some of phtay's third-party service providers — particularly game server operators and cloud infrastructure providers — may operate servers located outside the Philippines. Where personal data is transferred internationally in connection with these services, phtay ensures that such transfers are governed by appropriate safeguards including:

• Data processing agreements requiring the recipient to observe data protection standards equivalent to the Philippine DPA.
• Transfers to countries recognized by the NPC as providing an adequate level of data protection.
• Standard contractual clauses approved under applicable data protection frameworks.

phtay's primary data processing and storage infrastructure is located in facilities serving the Asia-Pacific region. Player data is not transferred to jurisdictions without adequate data protection frameworks without the safeguards described above.

phtay reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or regulatory guidance from the NPC. Where a change is material — affecting how we collect, use, or share your personal data in a way that may impact your rights — phtay will notify registered players by email at least 7 days before the change takes effect.

The "Effective Date" and "Last Updated" date at the top of this Policy will always reflect the current version. We encourage you to review this Policy periodically. Continued use of the Platform after notice of a material amendment constitutes acceptance of the revised Policy. If you do not agree with an amendment, you may request account closure before the effective date.

phtay has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and the Data Privacy Act of 2012. For any privacy-related queries, data rights requests, or concerns about how phtay handles your personal data, please contact the DPO through the following channels:

• Email: [email protected] — use subject line "Data Privacy Request" or "DPO Query" for priority routing to the privacy team.
• Live Chat: Available 24/7 within your phtay account — for general privacy questions and to initiate formal data rights requests.

All data privacy requests are acknowledged within 3 business days. Substantive responses to access, correction, and erasure requests are provided within 15 business days as required under RA 10173. If you are not satisfied with phtay's response to your privacy concern, you have the right to escalate to the National Privacy Commission of the Philippines.