Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") describes how ph36 ("ph36," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you," "the Player," or "the Data Subject") who access or use the ph36 online gaming platform at ph36.org and any associated mobile-optimized interfaces.

1.2 ph36 is committed to protecting the privacy and security of your personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1.3 By registering for a ph36 account or using any part of the ph36 platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the ph36 platform.

1.4 This Policy should be read alongside the ph36 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Data Controller

2.1 For the purposes of the Philippine Data Privacy Act of 2012, ph36 is the personal information controller in respect of the personal data it collects from players and platform users.

2.2 ph36 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data protection laws. Contact details for the ph36 DPO are provided in Section 14 of this Policy.

2.3 Where ph36 engages third-party service providers to process personal data on its behalf (for example, payment processors or identity verification providers), those parties act as personal information processors and are bound by data processing agreements that require them to process data only in accordance with ph36's instructions and applicable Philippine law.

3. Personal Data We Collect

3.1 ph36 collects the following categories of personal data from players and platform users:

3.2 ph36 does not intentionally collect sensitive personal information as defined under RA 10173 (such as health data, religious beliefs, or political affiliations) unless specifically required for responsible gaming assessments or as mandated by applicable law.

4. How We Collect Your Data

4.1 ph36 collects personal data through the following means:

• Direct collection: Information you provide when registering for a ph36 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically when you access the ph36 platform, including through cookies, log files, and similar tracking technologies (see Section 10);
• Third-party sources: Identity verification data from government ID databases or third-party KYC providers; fraud prevention data from industry databases; payment data from GCash, Maya, and Philippine banking partners.

4.2 ph36 will always inform you at the point of collection what data is being collected and for what purpose, unless the collection is automated and disclosed in this Policy.

5. How We Use Your Personal Data

5.1 ph36 uses your personal data for the following purposes:

• To create, verify, and manage your ph36 player account;
• To verify your identity and age (21+ requirement) in compliance with PAGCOR regulations;
• To process deposits and withdraw als via GCash, Maya, and Philippine bank transfers;
• To conduct anti-money laundering (AML) checks and comply with PAGCOR, AMLC, and other Philippine regulatory requirements;
• To monitor gaming activity for responsible gaming purposes and to enforce deposit, loss, and session limits;
• To detect, investigate, and prevent fraud, cheating, and other prohibited conduct;
• To provide customer support and resolve disputes;
• To send you transactional communications (account confirmations, deposit receipts, withdrawal notifications, security alerts);
• To send you promotional communications about ph36 offers and bonuses, where you have consented to receive such communications;
• To improve the ph36 platform through analysis of usage patterns and player feedback;
• To comply with any applicable Philippine law, court order, or regulatory direction.

5.2 ph36 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

6. Legal Basis for Processing

6.1 ph36 processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given clear, informed consent to the processing of your data for a specific purpose (e.g., receiving promotional emails);
• Contractual necessity: Where processing is necessary to perform the contract between you and ph36 (i.e., operating your player account, processing transactions);
• Legal obligation: Where processing is required to comply with a legal obligation applicable to ph36, including PAGCOR licensing conditions, AML obligations under RA 9160 as amended, and tax reporting requirements;
• Legitimate interests: Where processing is necessary for ph36's legitimate interests (e.g., fraud prevention, platform security, improving our services), provided those interests are not overridden by your rights and interests.

6.2 Where ph36 relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

7. Sharing Your Personal Data

7.1 ph36 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. ph36 may share your personal data with the following categories of recipients:

• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other Philippine government agencies, where required by law or regulatory direction;
• Payment processors: GCash, Maya, and Philippine banking partners, solely for the purpose of processing your deposits and withdrawals;
• Identity verification providers: Third-party KYC and age verification service providers engaged by ph36 to verify player identities in compliance with PAGCOR requirements;
• IT and platform service providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data on ph36's behalf under strict data processing agreements;
• Game content providers: Licensed game studios and live casino operators whose games are available on the ph36 platform, to the extent necessary to operate those games and resolve disputes;
• Legal and professional advisers: Lawyers, auditors, and other professional advisers engaged by ph36, subject to professional confidentiality obligations.

7.2 All third parties with whom ph36 shares personal data are required to process that data in accordance with applicable Philippine data protection law and ph36's data processing instructions.

7.3 ph36 does not transfer personal data outside the Philippines except where necessary to operate the platform (e.g., cloud infrastructure) and only where adequate data protection safeguards are in place.

8. Data Retention

8.1 ph36 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law.

8.2 The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with PAGCOR and AMLC record-keeping requirements;
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, in compliance with AML regulations;
• Gaming history: Retained for a minimum of three (3) years from the date of the gaming session;
• Customer support records: Retained for three (3) years from the date of the last interaction;
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of consent.

8.3 When personal data is no longer required, ph36 will securely delete or anonymize it in accordance with its data disposal procedures.

9. Security Measures

9.1 ph36 implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption of personal data in transit (TLS/SSL) and at rest;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of the ph36 platform;
• Two-factor authentication (2FA) options for player accounts;
• Continuous monitoring for suspicious activity and unauthorized access attempts;
• Staff training on data protection and information security obligations.

9.2 While ph36 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your ph36 account credentials. If you suspect unauthorized access to your account, please contact ph36 support immediately.

9.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ph36 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with NPC Circular No. 16-03.

10. Cookies & Tracking Technologies

10.1 ph36 uses cookies and similar tracking technologies (such as web beacons and local storage) on the ph36 platform. Cookies are small text files placed on your device that help us recognize you, maintain your session, and understand how you use the platform.

10.2 ph36 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language, display settings) to provide a more personalized experience.
• Analytics cookies: Help ph36 understand how players use the platform, which pages are most visited, and where improvements can be made. Data collected is aggregated and anonymized where possible.
• Marketing cookies: Used to deliver relevant promotional content about ph36 to you on the platform. These are only set with your consent.

10.3 You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the ph36 platform.

11. Your Data Subject Rights

11.1 Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ph36:

11.2 To exercise any of the above rights, please contact the ph36 Data Protection Officer using the details in Section 14. ph36 will respond to all verified data subject requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

11.3 ph36 may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to unauthorized parties.

12. Minors

12.1 The ph36 platform is strictly for persons aged 21 years and above. ph36 does not knowingly collect personal data from individuals under the age of 21. If ph36 becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed.

12.2 If you are a parent or guardian and believe that a minor has registered on the ph36 platform, please contact ph36 support immediately so that appropriate action can be taken.

13. Changes to This Policy

13.1 ph36 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or NPC guidance.

13.2 Where changes are material, ph36 will notify registered players via email or an in-platform notification at least fourteen (14) days before the changes take effect. The updated Policy will always be available at ph36.org/privacy-policy with the effective date clearly stated.

13.3 Your continued use of the ph36 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

14. Contact & Data Protection Officer

14.1 If you have any questions, concerns, or requests relating to this Privacy Policy or ph36's data processing practices, please contact the ph36 Data Protection Officer: