ph638 Privacy Policy

1. Data Controller

ph638 (hereinafter "ph638," "we," "us," or "our") is the data controller responsible for the personal information collected through the ph638 platform at ph638.app. ph638 processes personal data in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA) of the Philippines, and its Implementing Rules and Regulations, as overseen by the National Privacy Commission (NPC).

For all data privacy matters, players may contact ph638 via the contact details provided in Section 12 of this Policy.

2. Information We Collect

ph638 collects personal data that is necessary to provide a safe, compliant, and enjoyable gaming experience. The categories of information we collect include:

ph638 does not collect sensitive personal information beyond what is required for identity verification and AML compliance. We do not collect biometric data unless specifically required by regulatory instruction.

3. How We Use Your Information

ph638 uses personal data collected from players for the following purposes:

• Account management: Creating, verifying, maintaining, and securing player accounts on ph638;
• Identity and age verification: Confirming that players are at least 21 years of age in compliance with PAGCOR regulations and Philippine gaming law;
• Payment processing: Facilitating deposits via GCash, Maya, BPI, BDO, and other supported payment channels, and processing withdrawal requests;
• AML and fraud prevention: Monitoring transactions for suspicious activity and reporting to the appropriate Philippine regulatory authorities where required by law;
• Responsible gaming: Monitoring player behaviour to identify patterns associated with problem gambling and enforcing self-exclusion or deposit limit requests;
• Customer support: Responding to queries, resolving disputes, and delivering service-related communications;
• Platform improvement: Analysing aggregated usage data to improve the ph638 product, game selection, and user experience;
• Marketing communications: Sending promotional offers and bonus information to players who have opted in. Players may opt out at any time via account settings.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012, ph638 processes personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform the contract between ph638 and the player (i.e., providing gaming services);
• Legal obligation: Processing is required to comply with PAGCOR regulations, Philippine AML laws, and NPC directives;
• Legitimate interest: Processing is necessary for fraud prevention, platform security, and responsible gaming monitoring;
• Consent: For marketing communications, ph638 relies on the player's explicit opt-in consent, which may be withdrawn at any time.

5. Data Sharing and Disclosure

ph638 may share personal data with the following categories of third parties under strictly controlled conditions:

• Payment processors: GCash (G-Xchange Inc.), Maya (PayMaya Philippines), BPI, BDO, UnionBank, and other payment partners — solely for the purpose of executing financial transactions;
• Game providers: Licensed game studios that supply ph638's game content — limited to session data required for gameplay integrity;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and relevant law enforcement — where required by Philippine law or court order;
• KYC / identity verification services: Third-party providers engaged to assist with identity document verification and age confirmation;
• IT infrastructure and hosting providers: Cloud and server providers operating under data processing agreements with appropriate security standards.

All third-party data processors engaged by ph638 are required to process personal data only on ph638's documented instructions and to maintain security standards consistent with the DPA's requirements.

6. Cookies and Tracking Technologies

ph638 uses cookies and similar tracking technologies on ph638.app for the following purposes:

• Essential cookies: Required for the platform to function — including session management, login authentication, and security tokens. These cannot be disabled without impairing platform functionality.
• Analytics cookies: Used to understand how players navigate ph638, which pages are most visited, and where the platform experience can be improved. Data is aggregated and anonymised where possible.
• Preference cookies: Store player preferences such as language, interface settings, and notification options.

Players may manage non-essential cookies through their browser settings. Disabling essential cookies may prevent access to certain platform features. ph638 does not use cookies to serve third-party advertising.

7. Data Retention

ph638 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. Specifically:

• Account and transaction records are retained for a minimum of five (5) years from the date of the last transaction, in compliance with PAGCOR and AMLC record-keeping requirements;
• KYC and identity verification documents are retained for five (5) years from account closure;
• Support communications are retained for two (2) years from the date of resolution;
• Marketing opt-in records are retained for the duration of the player's account and for one (1) year following account closure or opt-out.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

ph638 employs technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between the player's device and ph638's servers;
• Encryption at rest for sensitive personal and financial data stored on ph638's systems;
• Role-based access controls limiting employee access to personal data to those with a demonstrated operational need;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Multi-factor authentication for all administrative access to ph638's data systems.

In the event of a personal data breach that is likely to give rise to a risk to player rights, ph638 will notify the National Privacy Commission and affected players in accordance with the DPA's breach notification requirements.

9. Your Rights Under the Data Privacy Act

As a data subject under the Republic Act No. 10173, Philippine players have the following rights with respect to their personal data held by ph638:

• Right to be informed: The right to know what personal data ph638 holds about you and how it is used — as described in this Privacy Policy;
• Right of access: The right to request a copy of the personal data ph638 holds about you;
• Right to rectification: The right to have inaccurate or incomplete personal data corrected;
• Right to erasure: The right to request the deletion of your personal data, subject to ph638's legal record-keeping obligations;
• Right to object: The right to object to processing carried out on the basis of legitimate interest, including direct marketing;
• Right to data portability: The right to receive your personal data in a structured, machine-readable format;
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of these rights, please contact ph638 via the details in Section 12. ph638 will respond to all verified data subject requests within thirty (30) days.

10. Children and Minors

Parents and guardians who believe a minor may have created a ph638 account should contact our support team immediately so that the matter can be addressed without delay.

11. Changes to This Privacy Policy

ph638 may update this Privacy Policy from time to time to reflect changes in our data practices, operational requirements, or applicable Philippine law. Where material changes are made, ph638 will notify registered players via the contact information associated with their account and will post the revised policy on this page with an updated effective date. Continued use of ph638 following notification of a material change constitutes acceptance of the revised Privacy Policy.

12. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or the exercise of your data privacy rights, please contact ph638's Data Protection Officer using the details below. All communications must be submitted in writing.