ph898 Privacy Policy —
How We Handle Your Personal Data

Introduction

ph898 ("ph898," "we," "us," "our") operates the online gaming platform accessible at ph898.one, serving registered Filipino players across the Philippines — from Metro Manila and Cebu to Davao and beyond. As a PAGCOR-licensed operator, ph898 is subject to both gaming regulatory requirements and the data privacy obligations imposed by Philippine law, principally the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations ("IRR").

This Privacy Policy ("Policy") describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data obtained through your use of the ph898 Platform, including the website at ph898.one, any associated mobile-optimized interfaces, and all communications channels operated by ph898. This Policy applies to all current and former registered players, as well as visitors to the ph898 website who have not completed registration.

Capitalized terms used but not defined in this Policy have the meanings given to them in the ph898 Terms and Conditions.

Data Controller

For the purposes of the Data Privacy Act of 2012, ph898 is the Personal Information Controller ("PIC") with respect to the personal data of Players and website visitors processed under this Policy. ph898 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with the DPA and all applicable PAGCOR data handling requirements.

ph898 has designated a Data Protection Officer ("DPO") responsible for overseeing data protection compliance, handling data subject requests, and acting as the point of contact for the National Privacy Commission ("NPC"). Contact details for the ph898 DPO are provided in Section 15 of this Policy.

Personal Data We Collect

ph898 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

ph898 does not collect sensitive personal information beyond what is strictly required for regulatory compliance (e.g., KYC). We do not collect biometric data, political opinions, religious beliefs, or health information except where directly relevant to a responsible gaming assessment requested by the Player.

How We Collect Personal Data

ph898 collects personal data through the following means:

• Direct Collection: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in promotions.
• Automated Collection: Technical data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you visit or use the ph898 Platform.
• Payment Processors: Transaction confirmation data from GCash, Maya, BPI, BDO, Metrobank, and other payment service providers involved in processing your deposits and withdrawals.
• Identity Verification Services: Data returned by third-party identity verification or fraud detection services used by ph898 to verify the authenticity of KYC documents.
• Publicly Available Sources: Where required for AML compliance, ph898 may cross-reference publicly available information such as sanctions lists, adverse media, and PEP (Politically Exposed Persons) databases.

Purpose & Legal Basis for Processing

ph898 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

Data Sharing & Disclosure

ph898 does not sell your personal data. We share personal data only in the following circumstances:

• Payment Service Providers: GCash (Globe Fintech), Maya/PayMaya, BPI, BDO, Metrobank, GrabPay, and other processors receive transaction data strictly necessary to process your deposits and withdrawals.
• Game Providers: JILI, PG Soft, Pragmatic Play, Evolution Gaming, Spadegaming, and other licensed game studios receive the minimum session data necessary to deliver their games on the ph898 Platform. Game providers are contractually bound to data confidentiality obligations.
• Identity Verification Services: Third-party KYC and fraud detection vendors receive the data necessary to verify your identity documents. All such vendors are contractually bound to process data only for the stated purpose.
• PAGCOR and Philippine Regulatory Authorities: ph898 is required by law to provide gaming data, financial records, and player information to PAGCOR upon request, and to report suspicious transactions to the Anti-Money Laundering Council (AMLC) as required under RA 9160.
• Law Enforcement: ph898 will disclose personal data to Philippine law enforcement agencies, courts, or other governmental bodies where required by a valid legal order, subpoena, or court mandate.
• Business Transfers: In the event of a merger, acquisition, or sale of ph898's business assets, personal data may be transferred to the acquiring entity, subject to continued compliance with this Privacy Policy and the DPA.

International Data Transfers

Certain ph898 technology partners, game providers, and support infrastructure are located outside the Philippines. When personal data is transferred to entities outside the Philippines, ph898 ensures that such transfers are conducted with appropriate safeguards, including:

• Contractual data processing agreements that impose obligations equivalent to those required under the DPA;
• Transfers to jurisdictions that the National Privacy Commission has recognized as providing adequate protection for personal data; or
• Other mechanisms permitted under the DPA and its IRR.

Your personal data will not be transferred internationally for any purpose other than those described in this Policy, and ph898 remains accountable for the protection of personal data throughout any such transfer.

Data Retention

ph898 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following specific retention periods:

• Account and KYC Records: Retained for a minimum of five (5) years following account closure, as required by PAGCOR regulations and Philippine AML law.
• Financial Transaction Records: Retained for a minimum of five (5) years in compliance with AML obligations and PAGCOR financial reporting requirements.
• Gaming Session Data: Retained for a minimum of two (2) years for dispute resolution and regulatory reporting purposes.
• Customer Support Records: Retained for two (2) years following resolution of the relevant support interaction.
• Technical/Log Data: Retained for ninety (90) days for security monitoring purposes, unless longer retention is required for an ongoing investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to any individual. Anonymized data may be retained indefinitely for aggregate analytics purposes.

Cookies & Tracking Technologies

ph898 uses cookies and similar tracking technologies on the ph898 website to enhance Platform functionality, maintain your session, and analyze usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for core Platform functionality including user authentication, session management, and security. These cannot be disabled.
• Functional Cookies: Remember your preferences (language, display settings) to improve your experience. Disabling these may affect Platform functionality.
• Analytics Cookies: Collect anonymized data about how visitors use the Platform to help ph898 identify and fix issues. Analytics data is not shared with advertising networks.
• Security Cookies: Help detect and prevent fraudulent activity, bot access, and unauthorized account access attempts.

ph898 does not use third-party advertising cookies or share tracking data with ad networks. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will prevent the Platform from functioning correctly.

Security Measures

ph898 implements technical and organizational security measures appropriate to the risk of processing, including:

• 256-bit TLS/SSL encryption for all data in transit between your browser and ph898 servers;
• Encryption of sensitive data at rest, including KYC documents and financial information;
• Role-based access controls ensuring that ph898 staff can access personal data only to the extent required for their specific job functions;
• Multi-factor authentication requirements for all staff accessing systems containing personal data;
• Regular security assessments and penetration testing of Platform infrastructure;
• Incident response procedures and a data breach notification process compliant with NPC requirements (notification within 72 hours of discovery for breaches affecting 500 or more data subjects, or those involving sensitive personal information).

Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph898:

• Right to Be Informed: The right to be informed of how your personal data is collected, used, and disclosed — which this Policy fulfils.
• Right to Access: The right to request a copy of the personal data ph898 holds about you, including information on how it has been processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. You may update most Account details directly through your Account settings.
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where processing is no longer necessary, subject to ph898's legal retention obligations (particularly AML and PAGCOR requirements, which may require retention for up to 5 years post-closure).
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time.
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe ph898 has violated your rights under the DPA.

To exercise any of these rights, contact ph898's Data Protection Officer via the details in Section 15. ph898 will respond to verifiable data subject requests within thirty (30) calendar days of receipt.

Children's Privacy & Age Restriction

If ph898 becomes aware that it has inadvertently collected personal data from a person under 21 years of age, it will immediately close the associated Account, forfeit any balances, and delete the personal data in question. If you believe that a minor has registered on the ph898 Platform, please contact ph898 Support via Live Chat immediately.

Marketing Communications

With your consent, ph898 may send you promotional communications via SMS to your registered Philippine mobile number regarding bonuses, promotions, new game launches, and platform updates. We do not send unsolicited marketing communications.

You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your ph898 Account settings;
• Replying "STOP" to any promotional SMS from ph898; or
• Contacting ph898 Support via Live Chat and requesting removal from our marketing list.

Withdrawal of marketing consent takes effect within 5 business days. Transactional communications (deposit confirmations, withdrawal notifications, OTP messages, security alerts) are not marketing and will continue regardless of your marketing preferences.

Changes to This Privacy Policy

ph898 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or Platform functionality. Where a change is material — meaning it significantly affects your rights or the way we process your personal data — ph898 will provide at least seven (7) days' prior notice via the Platform and/or by SMS to your registered mobile number.

The "Last Updated" date at the top of this page will reflect the date of the most recent revision. Your continued use of the ph898 Platform after the effective date of any revised Policy constitutes your acceptance of the revised terms. If you do not agree to the revised Policy, you should close your Account before the revised Policy takes effect.

Contact & Data Protection Officer

For all data privacy inquiries, data subject access requests, or privacy complaints, please contact ph898's Data Protection Officer through the following channels:

ph898 will acknowledge privacy requests within three (3) business days and provide a substantive response within thirty (30) calendar days, or notify you if additional time is required.

If you are not satisfied with ph898's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through their official government channels. ph898 fully cooperates with NPC investigations and inquiries.