ph638 Casino — Privacy Policy

ph638 Casino ("ph638," "we," "us," "our") operates the online casino and sports betting platform accessible at ph638.club (the "Platform"). This Privacy Policy describes how ph638 collects, uses, stores, shares, protects, and processes the personal data of individuals who visit, register with, or use the ph638 Platform ("you," "your," "the Player," "the Data Subject").

This Privacy Policy is issued pursuant to and in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Republic of the Philippines (the "DPA"), and its Implementing Rules and Regulations, as well as applicable guidelines issued by the National Privacy Commission ("NPC"). This Policy is also consistent with ph638's obligations under PAGCOR licensing requirements regarding Know Your Customer ("KYC") and Anti-Money Laundering ("AML") data handling.

By accessing the ph638 Platform, creating an account, or providing your personal data to ph638 in any form, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. This Privacy Policy should be read in conjunction with ph638's Terms & Conditions.

This Policy applies to all personal data processing activities conducted by ph638 in connection with the Platform, including data collected through the website, account registration, KYC verification, payment processing, customer support interactions, and marketing communications (where consent has been given).

ph638 collects the following categories of personal data from players and Platform users. Collection is limited to data that is necessary and proportionate for the specific purposes described in Section 4 of this Policy.

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for age verification — 21+ requirement under PAGCOR regulations).
• Philippine mobile number (primary account identifier and OTP delivery channel).
• Email address (where provided; used for account communications and promotional messages where consent is given).
• Chosen username.
• Account password (stored in hashed/encrypted form — ph638 does not store plaintext passwords).

• Copy or photograph of a valid Philippine government-issued photo ID (Passport, PhilSys National ID, Driver's License, SSS Card, UMID, or Voter's ID).
• Selfie photograph for facial verification against the submitted ID.
• Proof of address documentation (where requested as part of enhanced due diligence).
• Proof of payment method ownership (where applicable, e.g., confirmation of GCash account registration).

• Payment method details (e.g., registered GCash number, Maya account, bank account details) sufficient to process deposits and withdrawals.
• Deposit and withdrawal history, amounts, dates, and transaction reference numbers.
• Account balance and bonus credit information.
• Source of funds documentation (where required for AML compliance).

• Game session records including game titles played, bet amounts, win/loss outcomes, and session timestamps.
• Sports betting selections, stakes, and outcomes.
• Bonus and promotion usage records.
• VIP tier status and loyalty point accumulation.

• IP address at the time of account registration and each login session.
• Device type, operating system, and browser version.
• Session timestamps, login history, and geographic location data derived from IP address.
• Cookie identifiers and similar tracking technology data (see Section 10).

• Records of live chat, email, and other support communications between you and ph638.
• Feedback, complaint, and dispute records.
• Responsible gaming interaction records (e.g., self-exclusion requests, limit settings).

ph638 collects personal data through the following channels:

• Direct collection — data you actively provide to ph638 during account registration, KYC submission, payment transactions, customer support interactions, and promotional opt-ins.
• Automated collection — technical data collected automatically when you access the Platform, including IP address, device data, session logs, and cookie data (see Section 10).
• Third-party sources — where permitted by applicable law, ph638 may receive data from identity verification service providers, payment processors, fraud detection services, and credit risk screening services in connection with KYC and AML compliance activities.
• PAGCOR and regulatory authorities — ph638 may receive data from PAGCOR or other Philippine government authorities in connection with regulatory compliance, investigations, or licensing obligations.

ph638 processes personal data only for specified, legitimate purposes. The table below sets out the primary purposes for which ph638 processes your personal data and the corresponding legal basis for each purpose.

Under the Philippine Data Privacy Act of 2012, ph638 relies on the following lawful bases for processing your personal data:

• Consent — where you have given clear, informed, and freely given consent to the processing of your personal data for a specific purpose (e.g., marketing communications, optional data analytics).
• Contract Performance — where processing is necessary for the performance of the contract between you and ph638 (i.e., the ph638 Terms & Conditions), including operating your account, processing bets, and facilitating withdrawals.
• Legal Obligation — where processing is required to comply with ph638's obligations under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act itself.
• Legitimate Interests — where processing is necessary for ph638's legitimate business interests (e.g., fraud prevention, platform security, responsible gaming oversight) and those interests are not overridden by your rights and interests.

ph638 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. ph638 may share your personal data with third parties only in the following circumstances:

ph638 engages third-party service providers who process personal data on ph638's behalf and strictly under ph638's instructions, subject to binding data processing agreements. These include:

• KYC and identity verification technology providers.
• Payment processors and e-wallet providers (including GCash and Maya).
• Fraud detection and risk screening services.
• Cloud hosting and data storage infrastructure providers.
• Customer support platform providers.
• Casino game providers (who receive anonymised session data necessary to deliver gameplay).
• Email and SMS communication platforms for account and marketing notifications.

ph638 is required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where required by law, court order, or regulatory directive. ph638 will take reasonable steps to notify affected players of such disclosures where legally permitted to do so.

In the event of a merger, acquisition, sale of business assets, or restructuring of ph638's operations, personal data held by ph638 may be transferred to the acquiring or successor entity as part of that transaction, subject to the same privacy protections described in this Policy.

Some of ph638's third-party service providers, including cloud infrastructure providers and game providers, may be located outside of the Philippines. Where personal data is transferred to entities in countries that the NPC has not recognised as providing an adequate level of data protection, ph638 ensures that appropriate safeguards are in place, including:

• Standard contractual clauses approved by the NPC or equivalent supervisory authority.
• Binding corporate rules where applicable.
• Other lawful transfer mechanisms recognised under the DPA Implementing Rules and NPC guidelines.

By using the ph638 Platform, you acknowledge that your personal data may be processed in jurisdictions outside the Philippines in connection with the delivery of services described in this Policy.

ph638 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, ph638 will securely delete or anonymise personal data in accordance with NPC guidelines and ph638's internal data destruction procedures.

ph638 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or unlawful processing. These measures include:

• SSL/TLS Encryption (256-bit): All data transmitted between your device and the ph638 Platform is encrypted using industry-standard SSL/TLS protocols.
• Password Hashing: Account passwords are stored using a one-way cryptographic hashing algorithm. ph638 does not store or have access to your plaintext password.
• Two-Factor Authentication (2FA): ph638 offers SMS OTP-based 2FA for all accounts. Players are strongly encouraged to enable this feature.
• Access Controls: Access to personal data is restricted on a need-to-know basis. ph638 staff access to player data is logged and monitored.
• Regular Security Assessments: ph638 conducts regular security reviews and vulnerability assessments of its platform and data infrastructure.
• Fraud Detection Systems: Automated fraud detection monitors account activity for suspicious patterns, including unusual login behaviour, payment anomalies, and multi-accounting.
• Data Breach Response: ph638 maintains a documented incident response procedure. In the event of a personal data breach affecting your rights and freedoms, ph638 will notify the NPC and affected players in accordance with DPA requirements.

While ph638 takes reasonable and industry-appropriate measures to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your ph638 account credentials and for notifying ph638 promptly of any suspected unauthorised access.

ph638 uses cookies and similar tracking technologies on the Platform to enhance user experience, maintain session state, measure Platform performance, and support security functions. A "cookie" is a small text file placed on your device by a website when you visit it.

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your login state and security cookies used for fraud prevention. These cannot be disabled without significantly impairing Platform functionality.
• Functional Cookies: Store your preferences (e.g., language settings, game lobby layout preferences) to provide a personalised experience.
• Analytics Cookies: Collect anonymised data about how players use the Platform, which pages are visited, and where errors occur. This data is used to improve Platform performance and user experience.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts.

You may control cookie settings through your browser's privacy settings. Note that disabling strictly necessary cookies will impair your ability to log in to and use the ph638 Platform. ph638 does not use third-party advertising cookies or behavioural tracking cookies for external advertising networks.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ph638. To exercise any of these rights, please contact ph638's Data Protection Officer using the contact details in Section 15.

ph638 will respond to data subject requests within thirty (30) calendar days of receipt. Where the request is complex or involves a large volume of data, ph638 may extend this period by a further thirty (30) days, with notification of the extension provided to the requesting party. Requests may be submitted through the ph638 on-site live chat or by email to ph638's Data Protection Officer.

The ph638 Platform is strictly intended for adults aged 21 years and above, as mandated by PAGCOR. ph638 does not knowingly collect personal data from individuals under the age of 21. If ph638 becomes aware that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended, all data will be reviewed, and any personal data that is not required to be retained for regulatory compliance purposes will be deleted without undue delay.

If you are a parent or guardian and you believe your child under the age of 21 has provided personal data to ph638, please contact ph638's Data Protection Officer immediately using the contact details in Section 15.

The ph638 Platform may contain references to third-party services such as payment providers (GCash, Maya, BPI, BDO). When you interact with those services, you are subject to those third parties' own privacy policies and data practices. ph638 is not responsible for the privacy practices of third-party platforms and recommends that you review their privacy policies before providing any personal data to them.

ph638 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, NPC guidelines, PAGCOR requirements, or ph638's data processing practices. Material amendments will be communicated to registered players via their registered mobile number or email address, and/or through a prominent notice on the ph638 Platform, with a minimum of fourteen (14) calendar days' advance notice before the amended Policy takes effect, except where immediate amendment is required by law or regulatory directive.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the ph638 Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

ph638 has designated a Data Protection Officer (DPO) in accordance with the requirements of the Philippine Data Privacy Act of 2012. The DPO is responsible for overseeing ph638's data protection compliance and serves as the primary point of contact for data subject requests and privacy-related enquiries.