phtala Privacy Policy

01 Data Controller Identity

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, phtala acts as the Personal Information Controller (PIC) in respect of the personal data collected through the phtala platform. As a PIC, phtala determines the purposes for which and the means by which personal data is processed, and bears responsibility for ensuring that such processing is carried out in accordance with applicable data protection laws.

phtala operates the online gaming platform accessible at phtala.cam and is responsible for safeguarding the personal data of all registered users and site visitors in the Philippines and wherever the platform is legally accessible.

Any questions regarding phtala's role as a Personal Information Controller, or any exercise of data subject rights described in this Policy, should be directed to phtala's Data Privacy Officer at the contact details provided in Section 14 of this Policy.

02 Personal Data We Collect

phtala collects personal data that is necessary, relevant, and proportionate to the purposes for which it is collected. The categories of personal data phtala may collect include:

phtala does not collect sensitive personal information (as defined under the Philippine Data Privacy Act) beyond what is strictly required for identity verification and anti-money laundering compliance purposes. phtala does not request or store complete credit or debit card numbers through its platform.

03 How We Collect Your Data

phtala collects personal data through the following channels and mechanisms:

Direct Collection

Information you provide directly to phtala when you create an account, complete the KYC verification process, make a deposit or withdrawal, contact phtala's customer support team, or respond to surveys and promotional communications.

Automated Technical Collection

Technical data is automatically collected when you access the phtala platform — including your IP address, device identifiers, browser information, and session activity logs. This collection occurs through server logs, session management systems, and the platform's security and fraud detection infrastructure. For details on cookie-based collection, refer to Section 9 of this Policy.

Third-Party Sources

phtala may receive data about you from third-party sources where this is lawful and consistent with this Policy, including:

• Payment service providers (such as GCash, Maya, or partner banks) in connection with deposit and withdrawal transaction processing.
• Identity verification and anti-money laundering screening services used as part of the KYC compliance process.
• Fraud prevention and responsible gaming databases where phtala has a legitimate interest in verifying player eligibility or protecting the integrity of the platform.

04 Purposes of Data Processing

phtala processes your personal data only for specific, legitimate purposes. The primary purposes for which phtala processes personal data are as follows:

• Account Administration: Creating, maintaining, and managing your phtala account, including verifying your identity and eligibility to use the platform.
• Service Delivery: Enabling you to access and use the full range of phtala's gaming services, including deposits, withdrawals, game access, and bonus participation.
• Identity Verification and KYC Compliance: Verifying that you meet the 21+ age requirement and other eligibility criteria, and complying with applicable Know Your Customer obligations under Philippine law.
• Anti-Money Laundering (AML) Compliance: Monitoring transactions and gaming activity to detect and report suspicious activity in accordance with the Anti-Money Laundering Act of 2001 (Republic Act No. 9160) and its amendments, as enforced by the AMLC.
• Payment Processing: Processing deposits, withdrawals, and refunds using your registered payment method.
• Customer Support: Responding to your enquiries, resolving disputes, and providing assistance with your phtala account.
• Security and Fraud Prevention: Protecting the integrity of the phtala platform, detecting and investigating fraudulent or prohibited activity, and protecting both phtala and other players from harm.
• Responsible Gaming: Monitoring gaming behaviour patterns to identify signs of problem gambling, administering responsible gaming tools you request, and fulfilling our obligations related to player protection.
• Legal Compliance: Complying with applicable Philippine laws, regulations, court orders, and requests from competent regulatory or law enforcement authorities.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the phtala platform, personalise your experience, and develop new features.
• Marketing Communications: Sending you information about phtala promotions and offers, where you have consented to receive such communications. You may opt out of marketing communications at any time.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phtala processes your personal data on the following lawful bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and phtala — including account creation, service access, payment processing, and customer support — is carried out on the basis that it is necessary to fulfil phtala's contractual obligations to you as a registered player.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including AML compliance, KYC requirements, age verification obligations, and responses to lawful regulatory and law enforcement requests.
• Legitimate Interests: Processing carried out to protect the security and integrity of the phtala platform, prevent fraud, detect prohibited activity, and maintain accurate records — where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and certain non-essential cookies is conducted on the basis of your explicit consent. Where consent is the basis for processing, you retain the right to withdraw your consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

06 Disclosure and Data Sharing

phtala does not sell, rent, or trade your personal data to third parties for their own commercial purposes. phtala may share your personal data with the following categories of third parties, strictly in connection with the purposes described in this Policy:

Service Providers and Data Processors

phtala engages third-party service providers who process personal data on phtala's behalf and under phtala's documented instructions. These include payment processing partners (GCash, Maya, bank transfer partners), identity verification and KYC service providers, fraud detection and security infrastructure providers, and customer support technology providers. All such processors are required to implement appropriate data protection measures and may not use phtala player data for any purpose other than providing services to phtala.

Game Content Providers

Game software providers may receive technical session data (such as anonymised player session identifiers) necessary to deliver live dealer game streams and RNG game outcomes. These providers do not receive your identity or financial data except where required for the technical integration of game services.

Regulatory and Legal Authorities

phtala will disclose personal data to competent Philippine regulatory bodies, law enforcement agencies, or courts where required by law or legally enforceable court order. This includes disclosure obligations under the Anti-Money Laundering Act, reporting obligations related to suspicious transaction reports (STRs) to the Anti-Money Laundering Council (AMLC), and compliance requests from relevant gaming regulatory bodies.

Business Succession

In the event of a merger, acquisition, sale of assets, or similar corporate transaction affecting phtala, personal data held by phtala may be transferred to the relevant successor entity as part of that transaction, subject to the successor entity maintaining the same or equivalent data protection standards as those set out in this Policy.

07 Data Retention

phtala retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention principles apply:

• Active Account Data: Personal data associated with an active phtala account is retained for the duration of the account's existence and for a period of at least five (5) years following account closure, in accordance with AML record-keeping obligations under Republic Act No. 9160.
• KYC and Identity Verification Documents: Identity documents submitted for KYC verification are retained for a minimum of five (5) years following account closure or the date of the last transaction, whichever is later, as required by applicable anti-money laundering regulations.
• Transaction Records: Financial transaction records, including deposit and withdrawal logs, are retained for a minimum of five (5) years from the date of each transaction.
• Gaming Activity Logs: Game session and wagering records are retained for a minimum of three (3) years, or longer where required for active dispute resolution or regulatory compliance.
• Customer Support Records: Support communication records are retained for three (3) years from the date of the interaction, or longer where linked to an unresolved dispute or legal matter.
• Marketing Consent Records: Records of your marketing consent (or withdrawal of consent) are retained for the duration of the regulatory period during which they may be relevant.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification of the individual to whom the data relates.

08 Data Security Measures

phtala implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and the phtala platform is encrypted using SSL/TLS protocols (a minimum of TLS 1.2), consistent with industry standards applied by Philippine financial institutions.
• Encryption at Rest: Sensitive personal data stored in phtala's systems — including identity documents and financial identifiers — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within phtala is restricted to authorised personnel on a need-to-know basis. Access is subject to role-based permissions and is logged for audit purposes.
• Account Security Features: phtala provides players with optional two-factor authentication (2FA), login alerts for unrecognised devices, and account lockout mechanisms following multiple failed login attempts.
• Fraud Detection Systems: phtala operates automated fraud detection systems that monitor platform activity for anomalous patterns indicating unauthorized account access, payment fraud, or other security threats.
• Vendor Security Standards: Third-party service providers with whom phtala shares personal data are required to maintain security standards commensurate with those applied by phtala, as documented in applicable data processing agreements.

Notwithstanding these measures, no data transmission or storage system is entirely impenetrable. In the event of a personal data breach that is likely to result in harm to affected individuals, phtala will comply with its mandatory breach notification obligations under the Philippine Data Privacy Act, including notification to the National Privacy Commission (NPC) within the prescribed timeframe and notification to affected data subjects where required.

09 Cookies and Tracking Technologies

phtala uses cookies and similar tracking technologies to operate and improve the phtala platform, maintain your session state, and understand how players engage with the site. The following categories of cookies are used:

Strictly Necessary Cookies

These cookies are essential to the operation of the phtala platform. They maintain your login session, enable core security functions (such as CSRF protection), and ensure the platform functions correctly across page navigations. These cookies cannot be disabled without disabling essential platform functionality. They do not require your prior consent under applicable data protection frameworks.

Functional Cookies

Functional cookies remember your preferences — such as your chosen language or currency display settings — and improve the consistency of your phtala experience across sessions. These cookies do not track your activity across other websites.

Analytics Cookies

With your consent, phtala uses analytics cookies to collect anonymised data about how players navigate and use the phtala platform. This data is used in aggregate to identify usability issues and improve the platform experience. Individual player identities are not traceable from analytics data.

Managing Your Cookie Preferences

You can manage non-essential cookies through your browser settings. Most modern browsers (including Chrome, Firefox, Safari, and the browsers shipped on common Philippine Android devices) allow you to view, disable, or delete cookies stored by websites. Please note that disabling certain cookies may affect your ability to use some features of the phtala platform.

10 Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by phtala. phtala will respond to valid data subject rights requests within thirty (30) days of receipt.

To exercise any of the above rights, please submit a written request to phtala's Data Privacy Officer at the contact details in Section 14. phtala will verify your identity before processing any data subject rights request to prevent unauthorized disclosure of personal data. In some cases — particularly where legal retention obligations or AML compliance requirements apply — phtala may not be able to fulfil a deletion request in full, and will explain the reasons for any limitation in writing.

If you believe that phtala has not handled your personal data in accordance with applicable Philippine data privacy law, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

11 Data of Minors

The phtala platform is strictly intended for use by individuals who are 21 years of age or older, in compliance with Philippine gaming regulations. phtala does not knowingly collect personal data from persons under 21 years of age.

As part of the account registration and KYC verification process, phtala verifies the age of all registered users. Where phtala discovers or has reasonable grounds to believe that personal data of a person under 21 years of age has been collected — whether through misrepresentation of age during registration or any other means — phtala will promptly delete the relevant account and any associated personal data, and will return any deposited funds to the original payment source in accordance with phtala's underage gaming procedures.

If you are a parent or guardian and believe that a person under 21 in your care has created a phtala account, please contact phtala's support team immediately via the contact details in Section 14.

12 Cross-Border Data Transfers

In the course of providing its services, phtala may transfer personal data to service providers or technology infrastructure partners located outside the Philippines — for example, in connection with cloud hosting services, game content delivery networks, or payment processing infrastructure. Such transfers are conducted in compliance with applicable Philippine data privacy regulations.

Where personal data is transferred outside the Philippines, phtala ensures that appropriate safeguards are in place to protect the data at a standard consistent with the requirements of the Philippine Data Privacy Act of 2012, including through contractual protections with recipient entities. phtala does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual safeguards.

13 Amendments to This Policy

phtala reserves the right to amend this Privacy Policy from time to time to reflect changes in applicable law, data processing practices, or the services offered through the phtala platform. Where changes to this Policy are material — particularly changes that affect the purposes for which personal data is processed or the rights available to you — phtala will provide notice to registered players via email or a prominent on-platform notification prior to the changes taking effect.

The effective date of the most current version of this Policy is displayed at the top of this page. Your continued use of the phtala platform after the effective date of any amendment constitutes your acceptance of the revised Policy. The current version of this Privacy Policy will always be available at phtala.cam/privacy-policy.

14 Contact and Data Privacy Officer

phtala has designated a Data Privacy Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and handling data subject rights requests. For any privacy-related enquiries, requests to exercise your data subject rights, or to report a suspected data privacy concern, please contact phtala through the following channels:

• Data Privacy Officer Email: [email protected] (mark the subject line "Data Privacy Request")
• Live Chat: Available 24/7 on the phtala platform — for urgent privacy concerns requiring immediate attention.
• Response Time: phtala aims to acknowledge all data privacy requests within 72 hours and to provide a substantive response within thirty (30) calendar days.
• Support Languages: English and Tagalog — our team understands the local context and will communicate with you in your preferred language.

If you are not satisfied with phtala's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent regulatory body responsible for administering and enforcing the Philippine Data Privacy Act of 2012.