phgolden Privacy
Policy

Introduction and Scope

This Privacy Policy ("Policy") is issued by phgolden ("phgolden," "we," "us," "our") and applies to all personal data collected, processed, stored, and transferred in connection with your use of the phgolden platform, accessible at phgolden.lat ("Platform"), including all account features, games, payment services, customer support interactions, and marketing communications.

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC"). phgolden is committed to processing personal data lawfully, fairly, and transparently in accordance with these legal requirements.

By registering an Account on phgolden and accepting the Terms and Conditions, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not register an Account or use the Platform.

Identity of the Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 and its Implementing Rules, phgolden acts as the Personal Information Controller ("PIC") with respect to personal data collected from players and visitors to the Platform. As PIC, phgolden determines the purposes and means of processing personal data in connection with the Platform's operation.

For inquiries, data subject access requests, complaints, or any matter relating to the processing of your personal data by phgolden, you may contact our Data Protection Officer ("DPO") through the contact details set out in Section 14 of this Policy.

Categories of Personal Data We Collect

phgolden collects the following categories of personal data from players and Platform users. The specific data collected depends on your level of interaction with the Platform — registration, verification, gameplay, and payment activity each involve different data types:

phgolden does not collect sensitive personal information such as health records, religious affiliations, political beliefs, or biometric data beyond what is contained in submitted government identification documents for KYC purposes.

How We Collect Your Personal Data

phgolden collects personal data through the following means:

• Direct provision by you: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, configure responsible gaming tools, or communicate with phgolden through any channel, you directly provide personal data to us.
• Automatic collection during Platform use: When you access and use the Platform, technical and gaming data is automatically collected through server logs, session tracking systems, and browser/device information capture. This includes your IP address, device identifiers, and all game session activity associated with your Account.
• Cookies and similar technologies: phgolden uses cookies and related tracking technologies to maintain session authentication, personalize your Platform experience, analyze usage patterns, and support fraud prevention. See Section 7 for details on cookies and how to manage your preferences.
• Third-party payment providers: When you complete a deposit or withdrawal using GCash, Maya, BPI, BDO, Metrobank, or another approved payment channel, the relevant payment provider transmits transaction confirmation data to phgolden. phgolden does not receive or store full payment credentials — only the minimum information necessary to reconcile transactions.
• Third-party game providers: Game Provider platforms may transmit game session data (bet amounts, outcomes, session duration) to phgolden's account management systems for wallet reconciliation, bonus tracking, and regulatory reporting purposes.
• Identity verification services: phgolden may engage third-party KYC and identity verification service providers to assist in the review of submitted identification documents. These providers process personal data under strict confidentiality obligations and may not use the data for any purpose other than the KYC verification service.

Purposes of Processing and Legal Basis

phgolden processes personal data for the following purposes, each supported by an identified legal basis under the Data Privacy Act of 2012:

• Account registration and management — Processing is necessary for the performance of the contract between you and phgolden (the Terms and Conditions). Without this data, phgolden cannot provide access to the Platform.
• Identity verification (KYC) and age verification — Processing is necessary for compliance with phgolden's legal and regulatory obligations under the Philippine gaming regulatory framework and AML legislation. Verification of the 21+ age requirement is a mandatory legal obligation.
• Payment processing — deposits and withdrawals — Processing is necessary for the performance of the contract. Financial transaction data is also retained to satisfy AML compliance and regulatory reporting obligations.
• Fraud detection and prevention — Processing is necessary for the purposes of the legitimate interests of phgolden and its players in maintaining the integrity of the Platform and preventing financial crime, provided those interests are not overridden by your data protection rights.
• Customer support — Processing is necessary for the performance of the contract. Support interaction data enables phgolden to resolve account issues and improve service quality.
• Bonus, promotion, and VIP program management — Processing is necessary for the performance of the contract where you participate in promotional programs, and is based on your consent where opt-in marketing communications are sent.
• Responsible gaming compliance and player protection — Processing is necessary for compliance with phgolden's legal obligations regarding player welfare, and in the legitimate interest of protecting players from gambling-related harm.
• Regulatory reporting and compliance — Processing is necessary for compliance with applicable Philippine law, including anti-money laundering reporting obligations and gaming regulatory requirements.
• Platform analytics and improvement — Processing is based on phgolden's legitimate interest in understanding how the Platform is used and in making improvements to user experience, security, and game performance.

Sharing and Disclosure of Personal Data

phgolden does not sell, rent, or trade personal data to any third party for their own commercial or marketing purposes. Personal data may be shared with third parties only in the following limited circumstances:

• Payment processing partners: GCash (GXI/Mynt), Maya (Voyager Innovations), BPI, BDO, Metrobank, and other approved Philippine payment channel operators receive the minimum personal and transactional data necessary to process deposit and withdrawal requests. All payment partners are contractually required to process this data in accordance with applicable Philippine financial regulation and data protection law.
• Identity verification and KYC service providers: Third-party identity verification platforms engaged by phgolden may process identification document data on our behalf for the sole purpose of completing KYC checks. These providers act as Personal Information Processors ("PIPs") under the Data Privacy Act and operate under strict confidentiality and data processing agreements.
• Game technology providers: Game Providers integrated into the phgolden Platform receive the minimum account and session data necessary to operate game sessions (e.g., player account identifier, currency, balance). Game Providers do not receive your full personal identity data.
• Regulatory and law enforcement authorities: phgolden may be required to disclose personal data to the National Privacy Commission, the Philippine Anti-Money Laundering Council (AMLC), law enforcement agencies, or courts of competent jurisdiction when required by applicable Philippine law or court order. phgolden will comply with all legally valid disclosure requirements.
• Professional advisors: phgolden's legal counsel, auditors, and accountants may access personal data on a need-to-know basis and are bound by applicable professional confidentiality obligations.
• Business succession: In the event of a merger, acquisition, sale of assets, or reorganization of phgolden's business, personal data held by phgolden may be transferred to the acquiring or successor entity. Affected players will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

Cookies and Tracking Technologies

phgolden uses cookies and similar technologies (including local storage and session tracking identifiers) on the Platform. These technologies serve the following functions:

• Strictly necessary cookies: These are essential to the Platform's operation. They maintain your authenticated login session, prevent session hijacking, and enable core Platform functions. These cookies cannot be disabled without preventing use of the Platform.
• Functional cookies: These cookies remember your preferences — such as language and display settings — and personalize your experience on the Platform. They do not track you across other websites.
• Analytics cookies: phgolden uses first-party analytics tools to understand aggregate Platform usage — page traffic, session duration, feature usage, and similar metrics. This data is used in anonymized or pseudonymized form to improve the Platform. No individual player is identified in analytics reports.
• Security and fraud prevention cookies: These cookies and device identifiers are used by phgolden's fraud detection systems to identify unusual account activity, suspicious login patterns, and potential multi-accounting. They are part of phgolden's Platform integrity infrastructure.

phgolden does not use third-party advertising cookies or behavioral tracking cookies that track your activity across unrelated websites for advertising targeting purposes.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent login and access to account features. Session cookies are automatically deleted when you close your browser; persistent cookies expire on the timescale set in the cookie's attributes, typically 30 days for functional cookies.

Data Security Measures

phgolden implements a comprehensive set of technical, organizational, and procedural security measures to protect personal data against unauthorized access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your device and phgolden's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all Platform pages, login processes, and payment transactions.
• Encryption at rest: Personal data stored in phgolden's databases is encrypted using AES-256 encryption. Passwords are stored exclusively as salted cryptographic hashes — phgolden employees cannot view your plaintext password.
• Access controls: Access to personal data within phgolden's systems is restricted on a strict need-to-know basis. Employee access is controlled through role-based permissions, and all access to production databases is logged and subject to audit.
• Two-factor authentication (2FA): phgolden offers 2FA for all player accounts and requires it for all internal staff with access to production systems containing personal data.
• Regular security assessments: phgolden conducts regular security reviews of its Platform infrastructure, including periodic penetration testing and vulnerability assessments by qualified security professionals.
• Incident response procedures: phgolden maintains documented data breach response procedures, including detection, containment, assessment, notification, and post-incident review processes. The DPO is responsible for coordinating the response to any confirmed or suspected personal data breach.

While phgolden takes robust precautions to protect your data, no online platform can guarantee absolute security. You are encouraged to use strong, unique passwords for your phgolden Account, enable 2FA, and notify phgolden immediately if you suspect unauthorized access.

Data Retention

phgolden retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and identity data: Retained for the duration of the active Account and for a minimum of five (5) years following permanent Account closure, in compliance with AML record-keeping requirements and potential regulatory audit obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with AMLC reporting obligations and tax record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from Account closure or last transaction, whichever is later, as required by the Anti-Money Laundering Act and its implementing regulations.
• Gaming session records: Retained for five (5) years from the date of each session for regulatory reporting, dispute resolution, and responsible gaming compliance purposes.
• Customer support records: Retained for two (2) years from the closure of the relevant support case, or for the duration of the Account (whichever is longer), for quality assurance and dispute resolution purposes.
• Technical and analytics data: Aggregated and anonymized analytics data may be retained indefinitely as it no longer constitutes personal data. Raw technical logs containing identifiable information are retained for a maximum of 12 months.

Upon the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymized in accordance with phgolden's data disposal procedures.

Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by phgolden. These rights may be exercised by contacting the phgolden DPO through the details in Section 14:

To exercise any of the above rights, please contact phgolden's DPO in writing. phgolden will respond to verified requests within thirty (30) calendar days of receipt, or within the timeframe specified by the NPC's rules for particular types of request. Where a request is complex or voluminous, phgolden may extend this period by a further thirty (30) days with prior notification to you.

Children's Privacy and Minors

phgolden strictly prohibits the registration or use of the Platform by any person under the age of twenty-one (21) years. The Platform is not directed at, designed for, or intended to be used by minors under any circumstances. phgolden does not knowingly collect personal data from individuals under 21 years of age.

Where phgolden becomes aware — through KYC review, player reports, or any other means — that an Account has been registered by or is being operated by an individual under 21 years of age, that Account will be immediately suspended, all associated transactions will be reviewed, and the matter may be referred to the relevant Philippine regulatory authority. Any personal data collected in connection with a minor's Account will be deleted as soon as practicable following discovery, subject to any mandatory retention obligations for regulatory reporting purposes.

If a parent or guardian becomes aware that a minor has registered an Account on phgolden without their knowledge or consent, they should contact phgolden's support team immediately through the live chat channel or by email to [email protected].

Responsible Gaming Data

Personal data collected in connection with a player's use of phgolden's responsible gaming tools — including self-exclusion status, deposit limit configurations, session time settings, and any problem gambling referral records — is handled with particular care and is subject to the following specific provisions:

• Responsible gaming data is processed solely for the purposes of player protection, compliance with applicable responsible gaming obligations, and the operation of phgolden's responsible gaming program. It is not used for marketing profiling or commercial targeting.
• Self-exclusion records are retained for the duration of the exclusion period and for five (5) years thereafter, to prevent re-registration by excluded players and to fulfill potential regulatory audit requirements.
• Where phgolden identifies gaming patterns that indicate a player may be experiencing gambling-related harm, player welfare data may be used to apply protective account restrictions in accordance with phgolden's responsible gaming policy, even where a player has not voluntarily activated such restrictions.
• Responsible gaming data will not be shared with third parties except as required by law or as strictly necessary to operate phgolden's responsible gaming program (e.g., sharing exclusion status with a third-party exclusion registry where applicable).

For more information on phgolden's responsible gaming tools and player protection measures, please visit the Responsible Gaming page.

Changes to This Privacy Policy

phgolden reserves the right to update or amend this Privacy Policy at any time. Any changes will be reflected on this page with a revised "Last Updated" date. Where changes are material — meaning they significantly affect your rights or the way phgolden processes your personal data — phgolden will provide prominent notice on the Platform and, where feasible, notify affected players via their registered contact details prior to the changes taking effect.

Your continued use of the phgolden Platform following the effective date of any revision constitutes your acknowledgment of the revised Privacy Policy. If you disagree with any changes, you should cease using the Platform and may request Account closure by contacting phgolden's support team.

How to Contact phgolden About Privacy

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data by phgolden, please contact our Data Protection Officer through the following channels:

• Live Chat (Recommended): The fastest channel for privacy inquiries — available 24/7 directly through the phgolden Platform. Request to speak with a member of the data privacy team.
• Email: [email protected] — for written privacy requests, data subject access requests, and formal complaints. Mark the subject line as "Privacy / Data Subject Request" for prompt routing to the DPO.
• Messenger / Viber: Available through phgolden's official Filipino support channels for general privacy queries. For formal requests, email is recommended to ensure a proper written record.

phgolden's DPO will acknowledge receipt of privacy requests within five (5) business days and will endeavour to fully resolve requests within thirty (30) calendar days, as required by the Data Privacy Act of 2012 and NPC guidelines.