ph325 Privacy Policy

1. Introduction

ph325 ("the Platform," "we," "us," or "our") respects the privacy of every person who visits, registers, or interacts with our services at ph325.cam. This Privacy Policy describes how ph325 collects, uses, stores, shares, and protects personal data in connection with the operation of our online gaming platform, which is designed exclusively for Filipino players within the Republic of the Philippines.

ph325 is committed to upholding the principles of transparency, legitimate purpose, and proportionality as mandated by the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as enforced by the National Privacy Commission (NPC) of the Philippines. This policy is also informed by applicable PAGCOR regulations governing the handling of player data in licensed online gaming operations.

This Privacy Policy should be read alongside the ph325 Terms and Conditions and our Responsible Gaming Policy, all of which together govern your relationship with the ph325 platform.

2. Data Controller

ph325 acts as the Personal Information Controller (PIC) for all personal data collected through the ph325 platform. As PIC, ph325 determines the purpose and means by which your personal data is processed. Any questions regarding this policy or your personal data may be directed to our Data Protection Officer (DPO), whose contact details appear in Section 14 of this document.

3. Personal Data We Collect

ph325 collects only the personal data that is necessary to deliver our services, meet our legal and regulatory obligations, and provide you with a safe and personalized gaming experience. The categories of data we collect are as follows:

3.1 Identity and Account Data

• Full legal name as it appears on your government-issued ID
• Date of birth (for age verification — players must be 21 or older)
• Gender
• Nationality and country of residence
• Username and encrypted password
• Government-issued ID type, ID number, and ID document images (where verification is required)

3.2 Contact Data

• Mobile phone number (Philippine mobile number required)
• Email address
• Residential address (barangay, city or municipality, province)

3.3 Financial and Transaction Data

• GCash or PayMaya mobile wallet number (masked)
• Bank account details for BPI, BDO, or Metrobank transfers (account holder name and account number, masked)
• Deposit amounts, dates, and reference numbers
• Withdrawal amounts, dates, and processing status
• Bonus and promotional credit transactions
• Net gaming revenue per session

3.4 Gaming Activity Data

• Games played, session durations, and bet amounts
• Win and loss records per game and per session
• Bonus utilization and wagering progress
• Responsible gaming tool selections (e.g., deposit limits, self-exclusion status)

3.5 Technical and Device Data

• IP address and approximate geolocation (province/city level)
• Device type, operating system, and browser type
• Session login and logout timestamps
• Referring URL and internal navigation patterns
• Cookie identifiers and session tokens

3.6 Communications Data

• Live chat transcripts with ph325 support agents
• Email correspondence with ph325
• Survey responses and feedback submissions

4. How We Collect Your Data

ph325 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing identity verification, making deposits or withdrawals, or contacting support.
• Automated collection: Technical data gathered automatically when you access the platform, including IP addresses, device identifiers, and session data via cookies and server logs.
• Third-party providers: Identity verification services, payment processors (GCash, PayMaya, InstaPay), and gaming software providers may transmit transactional or verification data to ph325 as part of service delivery.
• Regulatory bodies: ph325 may receive data from PAGCOR or other regulatory authorities in the context of compliance checks or investigations.

5. Purpose and Legal Basis for Processing

ph325 processes personal data only for specific, legitimate purposes and on a lawful basis as recognized under RA 10173. The following table summarizes the primary purposes and their corresponding legal bases:

6. Sharing Your Personal Data

ph325 does not sell, rent, or trade your personal data to any third party for their own independent marketing purposes. We may, however, share your data with the following categories of recipients under strict confidentiality and data processing agreements:

6.1 Service Providers and Data Processors

ph325 engages trusted third-party service providers who process data on our behalf and under our instructions. These include payment processors (GCash, PayMaya, BancNet for InstaPay), identity verification providers, gaming software licensors (e.g., JILI, Evolution Gaming, Pragmatic Play), cloud infrastructure providers, and customer support software vendors. All processors are contractually bound to process data only as instructed by ph325 and to maintain appropriate security standards.

6.2 Regulatory and Law Enforcement Authorities

ph325 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities when required by law, court order, or legitimate regulatory request. ph325 will notify affected players of such disclosures where permitted by law and where doing so would not compromise an investigation.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of ph325 assets, your personal data may be transferred to the successor entity. You will be notified in advance of any such transfer and of any changes to this Privacy Policy that may result from it.

6.4 Affiliate and Group Entities

ph325 may share data with affiliated entities within the same corporate group for purposes of fraud prevention, compliance, and unified customer support. All affiliate data sharing is governed by intragroup data processing agreements that require the same level of data protection as this policy.

7. Data Retention

ph325 retains personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account's active status plus five (5) years after account closure, in compliance with AML record-keeping requirements under RA 9160.
• Transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by AMLC regulations.
• Identity verification documents: Retained for five (5) years from account closure or last transaction.
• Communications records: Retained for three (3) years from the date of communication.
• Technical and session logs: Retained for twelve (12) months for security monitoring purposes.
• Marketing consent records: Retained until you withdraw consent and for two (2) years thereafter.

Upon expiry of applicable retention periods, ph325 will securely delete, anonymize, or archive your personal data in a manner that prevents reconstruction of identifiable information.

8. Security Measures

ph325 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Key measures include:

• Encryption in transit: All data exchanged between your device and ph325 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive data fields — including passwords (hashed with bcrypt), payment details, and ID document images — are encrypted at the database level.
• Access controls: Access to player data is restricted to authorized ph325 personnel on a strict need-to-know basis, governed by role-based access control (RBAC) policies.
• Two-factor authentication (2FA): Available and encouraged for all ph325 player accounts via SMS OTP. 2FA is mandatory for internal administrative access.
• Intrusion detection and monitoring: ph325 operates 24/7 automated security monitoring for suspicious access patterns, brute-force attempts, and data exfiltration indicators.
• Regular security audits: ph325 conducts periodic third-party penetration testing and internal security audits to identify and remediate vulnerabilities.
• Data breach response: In the event of a personal data breach that poses risk to affected players, ph325 will notify the National Privacy Commission within 72 hours of discovery, and will notify affected players without undue delay as required by NPC regulations.

9. Cookies and Tracking Technologies

ph325 uses cookies and similar tracking technologies to operate and improve the platform experience. A "cookie" is a small text file placed on your device when you access a website. The following categories of cookies are used on ph325:

• Strictly necessary cookies: Essential for platform functionality — session authentication, security tokens, and load balancing. These cannot be disabled without breaking platform functionality.
• Performance and analytics cookies: Used to collect anonymized data about how players navigate and use ph325 — page views, session duration, error rates. This data is used solely to improve the platform and is not linked to individual identities.
• Functional cookies: Remember your preferences such as language settings, responsible gaming limit selections, and lobby display preferences.
• Marketing cookies: Used only with your consent, to deliver relevant ph325 promotional content. You may withdraw consent for marketing cookies at any time via your browser settings.

You may configure your browser to reject or delete cookies. Note that disabling strictly necessary cookies will affect the functionality of the ph325 platform. ph325 does not use cookies to serve advertising from third-party advertising networks.

10. Your Rights Under the Data Privacy Act

As a data subject under RA 10173, you have the following rights with respect to your personal data held by ph325:

• Right to be informed: You have the right to be informed of how ph325 collects and uses your personal data, as set out in this policy.
• Right of access: You may request a copy of the personal data ph325 holds about you, including a description of how it is used.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data in your ph325 account.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where the data has been processed unlawfully — subject to overriding legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where your individual circumstances warrant it.
• Right to data portability: You may request a structured, machine-readable copy of the personal data you have provided to ph325 for transfer to another service provider.
• Right to lodge a complaint: If you believe ph325 has not handled your personal data in accordance with RA 10173, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please contact the ph325 Data Protection Officer using the details in Section 14. ph325 will respond to all verified data subject requests within fifteen (15) business days of receipt of a complete request and supporting identification.

11. Minors and Age Restriction

The ph325 platform is strictly intended for adults aged 21 years and above, as required by PAGCOR regulations governing online gaming in the Philippines. ph325 does not knowingly collect personal data from individuals below the age of 21. If ph325 discovers or is notified that a person under 21 has created an account or submitted personal data, the account will be immediately suspended, all data will be deleted, and any funds will be returned to the registered payment method.

If you believe a minor has registered on ph325 using false information, please notify us immediately at [email protected]. We take underage gambling prevention seriously and will act on all credible reports without delay.

12. Cross-Border Data Transfers

ph325 primarily stores and processes personal data on servers located within the Philippines or in jurisdictions with equivalent data protection standards. Where personal data is transferred to or processed by service providers in other countries (for example, cloud infrastructure providers or gaming software vendors operating regionally), ph325 ensures that appropriate safeguards are in place — including contractual clauses requiring data protection standards equivalent to those under RA 10173 — prior to any such transfer.

ph325 does not transfer personal data to jurisdictions that have been identified by the National Privacy Commission as lacking adequate data protection frameworks, without first implementing additional protective measures as required by NPC guidelines.

13. Changes to This Privacy Policy

ph325 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this document and in the table of contents will be revised when changes are made.

For material changes that significantly affect your rights or the way your personal data is processed, ph325 will notify registered players via email and/or in-platform notification at least fourteen (14) days before the changes take effect. Your continued use of ph325 following the effective date of any changes constitutes acceptance of the updated policy.

14. Contact Us and Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or need to report a privacy concern, please contact the ph325 Data Protection Officer using the following contact details:

• Email: [email protected] (subject line: "Data Privacy Request")
• Live Chat: Available 24 hours a day, 7 days a week via the ph325 website — ask to be connected to the DPO team for privacy-related concerns.

ph325 will acknowledge all privacy-related inquiries within 24 hours and will provide a substantive response within fifteen (15) business days. For urgent matters involving potential data breaches or unauthorized access to your account, please contact support immediately via live chat for the fastest response.