phl9 Privacy Policy

This Privacy Policy ("Policy") describes how phl9 ("phl9", "We", "Us", or "Our") collects, processes, stores, and protects the personal information of individuals ("Data Subject", "You", or "Player") who access or use the phl9 online gaming platform available at phl9.cam (the "Platform").

This Policy applies to all personal data processed in connection with your registration, use of games and platform features, financial transactions, communications with phl9 support, and any other interaction with the Platform, whether accessed via desktop browser or mobile device anywhere in the Philippines — including Metro Manila, Cebu, Davao, and beyond.

phl9 is committed to full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission ("NPC") of the Philippines. In addition, phl9 adheres to all data privacy obligations imposed by PAGCOR on licensed online gaming operators.

For the purposes of the Philippine Data Privacy Act, phl9 is the Personal Information Controller with respect to the personal data of players collected and processed via the Platform. phl9 determines the purposes and means of processing your personal information and is accountable for ensuring that all processing activities comply with applicable Philippine data privacy law.

phl9 has designated a Data Protection Officer ("DPO") who oversees compliance with the Data Privacy Act, handles data subject rights requests, and serves as the primary contact for privacy-related inquiries. Contact details for the DPO are provided in Section 14 of this Policy.

phl9 collects the minimum personal data necessary to deliver the Platform's services, meet its regulatory obligations, and protect the security of players and the platform. The categories of data collected include:

phl9 does not intentionally collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as health, religious, or political data) unless specifically required by PAGCOR regulations or other applicable law and only with your explicit consent.

phl9 collects personal data through the following methods:

• Direct Provision: Data you actively provide during account registration, KYC verification, deposit or withdrawal requests, support ticket submissions, or other direct interactions with phl9.
• Automated Collection: Technical and gaming data collected automatically when you access the Platform, including through cookies, web beacons, server logs, and session tracking technologies.
• Third-Party Sources: Identity verification data from KYC service providers; fraud and risk signals from payment processors (GCash, PayMaya, BPI, BDO, Metrobank); IP geolocation data from technical service providers; and publicly available information from Philippine government databases where legally permitted.
• Regulatory Sources: Data shared with phl9 by PAGCOR or other competent Philippine authorities in the discharge of regulatory obligations, including national self-exclusion databases.

phl9 processes your personal data only where a lawful basis exists under the Data Privacy Act. The following table sets out the primary processing purposes and their corresponding legal bases:

phl9 does not sell, rent, or trade your personal data to third parties for commercial purposes. Your data may be disclosed to the following categories of recipients only where necessary and under appropriate data sharing agreements or legal authority:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, for the processing of deposits and withdrawals. Disclosure is limited to data strictly necessary for the transaction.
• KYC and Identity Verification Providers: Third-party service providers that assist phl9 in verifying the identity and age of players in compliance with PAGCOR requirements and Anti-Money Laundering Act (AMLA) obligations.
• Game Content Providers: Third-party game studios (e.g., JILI, PG Soft, Pragmatic Play) may receive game session data in a pseudonymised form to deliver their gaming products. These providers are contractually prohibited from using player data for any purpose other than game delivery.
• Regulatory Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government bodies as required by law.
• IT and Security Service Providers: Cloud hosting providers, cybersecurity firms, and fraud-detection service providers operating under strict contractual data protection obligations.
• Legal and Professional Advisers: Lawyers, auditors, and compliance consultants bound by professional confidentiality obligations, where necessary for phl9's legal and regulatory compliance.

Some third-party service providers engaged by phl9 — including certain game content providers and cloud infrastructure providers — may process or store data in servers located outside the Philippines.

Where personal data is transferred outside the Philippines, phl9 ensures that such transfers are conducted in accordance with Section 21 of the Data Privacy Act, which requires that the recipient country or organization provides a level of data protection at least equivalent to that required under Philippine law. This is achieved through the use of standard contractual clauses, data processing agreements, and where applicable, adequacy assessments conducted prior to transfer.

phl9 will not transfer your personal data to jurisdictions that do not provide adequate protection without your prior explicit consent, except where required by law.

phl9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. The following retention periods apply:

Upon expiry of the applicable retention period, phl9 will securely delete or anonymize your personal data in a manner that prevents reconstruction or re-identification.

phl9 implements a comprehensive suite of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These include:

• Transport Encryption: All data transmitted between your device and the phl9 Platform is encrypted using industry-standard TLS (Transport Layer Security) protocols. Your login credentials, financial data, and personal details are never transmitted in plain text.
• Data-at-Rest Encryption: Sensitive personal data stored in phl9's databases is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to systems containing personal data is restricted on a strict need-to-know basis, enforced through role-based access controls, multi-factor authentication, and audit logging.
• Penetration Testing and Vulnerability Management: phl9's technical infrastructure undergoes regular third-party security assessments and vulnerability scans.
• Incident Response: phl9 maintains a formal data breach incident response plan. In the event of a personal data breach that poses a real risk to Filipino players, phl9 will notify affected data subjects and the National Privacy Commission within the timeframes required by the Data Privacy Act.

While phl9 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords and to enable SMS two-factor authentication (2FA) on their phl9 accounts.

phl9 uses cookies and similar tracking technologies to operate the Platform, enhance user experience, and support security and analytics functions. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without impairing the Platform's functionality.
• Functional Cookies: Remember your preferences — such as language settings, game display preferences, and responsible gaming limit configurations — across sessions.
• Analytics Cookies: Collect anonymized or pseudonymized data about how players navigate the Platform, enabling phl9 to improve usability and performance. These are only set with your consent.
• Security Cookies: Used for fraud detection, bot mitigation, and account security monitoring.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your phl9 account. phl9 does not use cookies to serve third-party advertising networks.

Under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by phl9. To exercise any of these rights, contact phl9's Data Protection Officer at the details provided in Section 14.

phl9 will respond to valid data subject rights requests within fifteen (15) business days of receipt. In complex cases, this period may be extended by a further fifteen (15) business days, with notification to the data subject of the extension and the reason for it.

phl9 does not knowingly collect personal data from persons under 21 years of age. The phl9 Platform is strictly intended for adults who meet the minimum age requirement under PAGCOR's online gambling regulations. Age verification is conducted as part of the mandatory KYC process during account registration.

If phl9 becomes aware that personal data has been collected from an individual under 21 years of age without the legally required consent, phl9 will:

• Immediately suspend and permanently close the relevant account.
• Delete all personal data associated with the account, except where retention is required by law (e.g., AMLC reporting obligations).
• Return any deposits net of any withdrawals already made, in accordance with PAGCOR's underage gambling protocols.
• Report the matter to PAGCOR as required by the operator's regulatory obligations.

phl9 may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, PAGCOR regulations, NPC guidelines, or phl9's data processing practices.

Material changes to this Policy will be communicated to registered players via SMS to the mobile number on record and/or by a prominent notice on the Platform, at least seven (7) days before the change takes effect. Non-material changes (such as typographical corrections or clarifications that do not alter your rights) may be made without prior notice.

The updated Policy will be published on this page with a revised effective date. Continued use of the phl9 Platform after the effective date of a revised Policy constitutes your acknowledgment of the updated terms. If you do not agree with a material change, you may close your account before the change takes effect.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by phl9 — including the exercise of your data subject rights under the Philippine Data Privacy Act — please contact phl9's Data Protection Officer through the following channels:

• Privacy Email: [email protected] (Subject line: "Data Privacy Request — [Your Registered Mobile Number]")
• Live Chat: Available 24/7 via the chat widget on phl9.cam — select "Account & Privacy" from the support menu
• Messenger / Viber: Via phl9's official verified accounts, accessible from your phl9 dashboard after login

If you are not satisfied with phl9's response to your privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC). Information on the NPC complaints process is available on the NPC's official website.