phplago Privacy Policy

This Privacy Policy ("Policy") describes how phplago ("phplago," "we," "us," or "our") collects, processes, stores, shares, and protects the personal information of individuals who visit, register with, or use the phplago online gaming platform accessible at phplago.app ("Platform"). It also explains the rights that you, as a phplago player or visitor, hold in relation to your personal information under the Republic Act No. 10173, also known as the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations.

phplago is committed to respecting and protecting the privacy of every individual whose data it processes. This Policy is designed to be clear, honest, and readable — not a document meant to confuse or mislead. If you have questions about anything contained here, we encourage you to reach out to us directly at [email protected].

By creating a phplago account or using the Platform in any capacity, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, please do not use phplago.

phplago is the data controller responsible for the personal information processed through the Platform. As data controller, phplago determines the purposes and means of processing personal information collected from players and visitors.

For all data privacy matters, including requests to exercise your rights, corrections, complaints, or inquiries, you may contact phplago's Data Protection Officer (DPO) via email at [email protected]. All data privacy inquiries are handled by a dedicated team and acknowledged within 72 hours of receipt.

phplago collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third parties such as payment processors and identity verification services. The categories of personal data we collect include:

phplago processes your personal data only for specified, legitimate purposes. The following table describes each processing purpose and its corresponding legal basis under the Data Privacy Act of 2012:

phplago is required by PAGCOR regulations and Anti-Money Laundering laws to verify the identity of all players prior to processing withdrawal transactions. This process, commonly referred to as Know Your Customer ("KYC"), involves the following:

• Document collection: You must submit a clear image of a valid Philippine government-issued photo ID. Accepted documents include: UMID, SSS ID, PhilHealth ID, Driver's License, Passport, and Philippine National ID (PhilSys).
• Facial verification: In some cases, phplago may request a selfie photograph to confirm the document belongs to you.
• Proof of payment method: For certain withdrawal channels, you may be asked to confirm ownership of the GCash or bank account used for payouts.
• Source of funds: For large transactions, phplago may request documentation demonstrating the legitimate source of deposited funds in compliance with AMLC requirements.

KYC documents are processed by phplago's internal verification team and, where applicable, through trusted third-party identity verification service providers who are bound by strict confidentiality obligations. KYC documents are retained for the minimum period required by applicable Philippine law and then securely deleted.

All financial transactions on phplago are conducted in Philippine Peso (PHP / ₱) through regulated Philippine payment channels. phplago processes payment data in partnership with licensed payment service providers. The following rules apply to the handling of your financial data:

• phplago does not store complete credit or debit card numbers. Card details, where applicable, are processed directly by PCI-DSS-compliant payment processors.
• GCash and PayMaya mobile numbers are stored in encrypted form and are accessible only to authorized phplago staff for the purpose of processing transactions.
• All transaction history — deposits, withdrawals, bonus credits, and wager records — is retained for a minimum of five (5) years as required by Philippine AMLC regulations.
• phplago's payment processors may independently collect and retain transaction data under their own privacy policies. These are third-party processors subject to their own Philippine regulatory obligations.

phplago uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate and improve the Platform. The cookies used by phplago fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function — including session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, display preferences, and previously entered game filters to improve your phplago experience.
• Analytics cookies: Collect aggregated, anonymized data about how players use the Platform — pages visited, features used, session duration — to help phplago improve its services. phplago does not use analytics cookies for individual profiling.
• Security and fraud-prevention cookies: Monitor for suspicious activity such as automated login attempts, multiple account creation from a single device, and unusual betting patterns.

phplago does not use third-party advertising or behavioral tracking cookies. You may control cookie preferences through your browser settings; however, disabling strictly necessary cookies will impair platform functionality, including the ability to log in to your phplago account.

phplago does not sell, rent, or trade your personal information to any third party for commercial purposes. We share personal data only in the following circumstances and only to the extent necessary:

• Payment processors: GCash, PayMaya, and banking partners receive transaction data necessary to process your deposits and withdrawals. These processors are independently regulated under Philippine financial law.
• KYC verification providers: Third-party identity verification services that assist phplago in processing and validating government-issued ID documents submitted during the KYC process.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where phplago is legally required to report or disclose information.
• Law enforcement: Philippine law enforcement agencies, where phplago receives a valid legal order or warrant requiring disclosure of player information in connection with a criminal investigation.
• IT and infrastructure providers: Cloud hosting and database service providers that process data on phplago's behalf under strict data processing agreements that bind them to confidentiality and security obligations equivalent to those applied by phplago.
• Business continuity: In the event of a merger, acquisition, or sale of substantially all assets of phplago, player data may be transferred to a successor entity, subject to that entity maintaining at least equivalent data protection standards and providing notice to affected players.

phplago implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the phplago Platform.
• AES-256 encryption for sensitive data stored in phplago databases, including KYC documents, financial records, and authentication credentials.
• Multi-factor authentication (MFA) required for all internal staff access to systems containing player personal data.
• Role-based access controls ensuring that phplago staff access only the minimum personal data necessary for their specific job function.
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified third-party security specialists.
• Comprehensive audit logging of all access to, and modifications of, records containing personal data, with log retention for a minimum of two years.
• Incident response procedures that include player notification within 72 hours in the event of a personal data breach affecting their information, in accordance with NPC Circular requirements.

While phplago takes all reasonable precautions, no system is entirely immune to security incidents. phplago encourages all players to enable two-factor authentication on their accounts, use strong unique passwords, and report any suspicious account activity immediately to [email protected].

phplago retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, or as required by applicable Philippine law, whichever is longer. The following general retention periods apply:

• Active account data: Retained for the duration of your phplago account and for a period of five (5) years following permanent account closure.
• KYC identity documents: Retained for a minimum of five (5) years following account closure, as required by PAGCOR regulations and AMLC rules.
• Financial transaction records: Retained for a minimum of five (5) years following the transaction date, as required by AMLC and BSP regulations applicable to online payment processing.
• Communications records: Live chat transcripts and email correspondence retained for two (2) years following the relevant interaction.
• Cookie and analytics data: Aggregated analytics data retained for up to twelve (12) months before anonymization. Session authentication cookies expire at the end of each browser session unless "Keep me logged in" is selected.
• Responsible gaming records: Self-exclusion records retained for the duration of the exclusion period plus three (3) years to prevent circumvention.

Upon expiry of applicable retention periods, personal data is securely deleted using certified data destruction methods or irreversibly anonymized so that it can no longer be associated with any identifiable individual.

Under the Philippine Data Privacy Act of 2012, you hold the following rights in relation to your personal data processed by phplago. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your phplago account. phplago will respond within fifteen (15) business days of receiving a verifiable request.

The phplago Platform is strictly restricted to individuals who are at least twenty-one (21) years of age. phplago does not knowingly collect personal information from persons under 21 years of age. Age is verified through mandatory KYC identity verification prior to the processing of any withdrawal and is checked at registration through date-of-birth collection.

If phplago becomes aware that personal data has been collected from a person under 21, the relevant account will be closed immediately, collected personal data will be deleted to the extent permitted by law, and deposited funds (net of any bonuses claimed) will be returned to the payment source. If you believe that a minor has registered a phplago account, please contact us immediately at [email protected].

phplago sends players promotional communications — including bonus offers, reload promotions, game announcements, and platform updates — only where the player has opted in to receive such communications at registration or through their account notification settings.

• You may opt out of marketing communications at any time by updating your notification preferences in your phplago account settings or by contacting [email protected] with an opt-out request.
• Opting out of marketing communications will not affect the delivery of transactional communications — including deposit confirmations, withdrawal processing notices, account security alerts, and responsible gaming notifications — which are sent regardless of marketing preferences as they are necessary for the operation of your account.
• phplago does not share your contact details with third-party marketers. All promotional communications are sent by phplago directly.
• Players who have activated self-exclusion under phplago's Responsible Gaming program will be automatically removed from all marketing mailing lists for the duration of the exclusion period.

phplago may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or the Platform's features. When we make material changes to this Policy, we will notify registered players via email and/or an in-platform notification at least seven (7) days before the changes take effect.

The effective date displayed at the top of this Policy indicates when the current version came into force. The most current version of the phplago Privacy Policy will always be accessible at phplago.app/privacy-policy. Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

If you disagree with any material change to this Policy, you may close your phplago account before the change takes effect by contacting [email protected].

For all data privacy matters, including requests to exercise your rights, questions about this Policy, or to report a suspected data breach, please contact phplago's Data Protection Officer:

• Email: [email protected] — mark the subject line "Data Privacy Request" for priority routing to the DPO team
• Live Chat: Available 24/7 on the phplago Platform — Filipino-speaking agents available
• Response Commitment: All data privacy requests acknowledged within 72 hours; substantive response within 15 business days

If you believe phplago has handled your personal data in violation of the Data Privacy Act of 2012 and your concern has not been satisfactorily resolved after contacting phplago directly, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines at [email protected] or by visiting the NPC's official website.

This Privacy Policy was last reviewed and updated on 1 January 2026. All prior versions are superseded by this document.