phpgroup Privacy Policy

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal data by phpgroup in connection with the operation of the phpgroup online gaming and sports betting platform accessible at phpgroup.one (the "Platform").

phpgroup recognises its obligations under applicable Philippine data privacy law, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission of the Philippines (NPC). This Policy is intended to satisfy phpgroup's transparency obligations to data subjects under that framework.

By registering an Account on the phpgroup Platform or by continuing to use phpgroup services, you acknowledge that you have read this Policy and consent to the processing of your personal data as described herein. If you do not agree with this Policy, you should not use the phpgroup Platform.

This Policy is incorporated by reference into the phpgroup Terms and Conditions. Capitalised terms not defined in this Policy have the meanings given to them in the phpgroup Terms and Conditions.

For the purposes of applicable data privacy legislation, phpgroup acts as the personal information controller (or "data controller") in respect of the personal data of Players collected and processed through the phpgroup Platform.

As data controller, phpgroup is responsible for determining the purposes and means by which your personal data is processed. phpgroup implements appropriate technical and organisational measures to protect your data and to ensure compliance with applicable privacy obligations.

phpgroup collects the following categories of personal data in connection with the operation of the Platform and the provision of gaming services to Filipino players:

3.1 Registration & Identity Data

• Full legal name (as it appears on a government-issued Philippine ID);
• Date of birth;
• Gender;
• Nationality;
• Registered email address;
• Philippine mobile number;
• Residential address (barangay, city, province).

3.2 Identity Verification (KYC) Data

• Copies of government-issued Philippine photo identification (e.g., PhilSys National ID, UMID, Driver's License, or Passport);
• Proof of address documentation;
• Proof of payment method ownership (e.g., GCash account screenshot, bank statement);
• Source of funds declarations where required by anti-money laundering obligations.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts, timestamps, and payment channels used (GCash, Maya, BPI, BDO, Metrobank, USDT, Coins.ph, 7-Eleven);
• Account balance history;
• Wagering history across all phpgroup game categories (live casino, slots, sports betting, bingo, arcade);
• Bonus and promotion redemption records.

3.4 Technical & Usage Data

• IP address at time of login and during sessions;
• Device type, operating system, and browser information;
• Session duration and activity logs;
• Pages accessed and game sessions initiated;
• Geolocation data (country/city level) derived from IP address.

3.5 Communication Data

• Content of communications submitted via phpgroup Support live chat;
• Email correspondence with phpgroup;
• Records of formal complaints submitted by Players.

3.6 Responsible Gaming Data

• Deposit limits, loss limits, and session controls set by the Player;
• Cooling-off period and self-exclusion records;
• Responsible gaming assessment questionnaire responses where completed.

4.1 Directly From You

The majority of personal data phpgroup holds is provided directly by you during Account registration, KYC verification, payment transactions, gameplay activity, and communications with phpgroup Support. This includes all data submitted through the phpgroup Platform interface.

4.2 Automatically During Platform Use

phpgroup automatically collects technical and usage data when you access and use the Platform. This data is collected via server logs, session tracking, and cookies as described in Section 10 of this Policy.

4.3 From Third-Party Service Providers

phpgroup may receive data from third-party service providers in the course of Platform operations, including:

• Identity verification and KYC service providers;
• Payment processors including GCash (GXchange Inc.), Maya (PayMaya Philippines Inc.), and banking institutions;
• Anti-fraud and anti-money laundering screening services;
• Game providers whose titles are integrated into the phpgroup Platform.

phpgroup processes your personal data for the following purposes, each supported by a corresponding legal basis under the Data Privacy Act of 2012 and applicable regulations:

phpgroup does not sell your personal data to third parties for commercial purposes. phpgroup may share your personal data with the following categories of third parties where necessary and proportionate to the purposes described in this Policy:

6.1 Service Providers

phpgroup engages service providers who process personal data on phpgroup's behalf under strict data processing agreements. These include KYC and identity verification providers, payment processors (including GCash / GXchange Inc. and Maya / PayMaya Philippines Inc.), fraud and risk analytics providers, cloud infrastructure providers, customer support platform providers, and game software licensors.

6.2 Regulatory & Law Enforcement Authorities

phpgroup may disclose personal data to Philippine regulatory authorities (including PAGCOR and the Anti-Money Laundering Council / AMLC), law enforcement agencies, courts, or other competent authorities where required by applicable law, regulation, court order, or in connection with investigations into suspected fraud, money laundering, or other criminal activity.

6.3 Business Succession

In the event of a merger, acquisition, restructuring, or sale of all or part of phpgroup's business, personal data held by phpgroup may be transferred to the acquiring or successor entity, subject to equivalent privacy protections.

6.4 Player Consent

phpgroup may share personal data with third parties for purposes not listed above where you have given your explicit, informed, and freely given consent to such sharing.

phpgroup's primary data infrastructure is operated to serve Filipino players across the Philippines. Where personal data is transferred to or processed in a jurisdiction outside the Philippines — for example, by a cloud infrastructure provider or game technology provider with servers located in other countries — phpgroup ensures that such transfers are carried out in compliance with the cross-border data transfer requirements of the Data Privacy Act of 2012.

Such transfers will be protected by one or more of the following safeguards: contractual clauses that impose equivalent data protection obligations on the recipient; adequacy determinations by the National Privacy Commission; or binding corporate rules applicable to corporate group entities.

If you require further information about the safeguards applied to a specific international data transfer, you may contact phpgroup using the contact details in Section 16 of this Policy.

phpgroup retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes that may arise.

8.1 Active Account Data

Personal data associated with an active phpgroup Account is retained for the duration of the Account's active period and for a minimum of five (5) years following Account closure, in line with anti-money laundering record-keeping obligations applicable to Philippine gaming operators.

8.2 Transaction Records

Financial transaction records including deposit, withdrawal, and wagering history are retained for a minimum of five (5) years from the date of each transaction, as required by applicable Philippine AML legislation.

8.3 KYC Documentation

Identity verification documents submitted by Players are retained for the period required by applicable regulatory guidance, and in any event for a minimum of five (5) years following Account closure or the completion of the last transaction to which the document relates.

8.4 Marketing Data

Personal data held for the purpose of marketing communications is retained until you withdraw your consent or unsubscribe, or for a period not exceeding three (3) years from your last interaction with phpgroup marketing content, whichever is earlier.

8.5 Deletion

Upon expiry of the applicable retention period, phpgroup will securely delete or anonymise your personal data such that it can no longer be linked to you as an individual, except where retention is required by law.

phpgroup implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and phpgroup's servers is protected using industry-standard TLS (Transport Layer Security) encryption. Sensitive data at rest is encrypted using AES-256 or equivalent standards;
• Access Controls: Access to systems holding personal data is restricted to authorised phpgroup personnel on a need-to-know basis, enforced by role-based access controls and multi-factor authentication for privileged access;
• Intrusion Detection: phpgroup operates continuous network monitoring and intrusion detection systems to identify and respond to potential security threats;
• Penetration Testing: phpgroup conducts regular independent security assessments and penetration testing of its platform and data infrastructure;
• Incident Response: phpgroup maintains a documented data breach incident response procedure. In the event of a personal data breach that poses a risk to affected Players, phpgroup will notify the National Privacy Commission and affected Players within the timeframes required by the Data Privacy Act;
• Staff Training: All phpgroup staff with access to personal data receive mandatory data privacy and security training.

10.1 What Are Cookies

Cookies are small text files placed on your device when you access the phpgroup Platform. phpgroup uses cookies and similar tracking technologies (including web beacons and local storage) to operate the Platform, recognise returning users, maintain session state, and analyse usage patterns.

10.2 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function. These cannot be disabled without impairing core Platform functionality (e.g., session authentication, login state maintenance);
• Functional Cookies: Remember your preferences and settings (e.g., language preference, preferred game lobby view) to improve your experience;
• Analytics Cookies: Used to collect aggregated, anonymised data about how Players use the Platform, enabling phpgroup to identify technical issues and improve functionality;
• Session Security Cookies: Used to detect and prevent fraud and protect account security during login sessions.

10.3 Managing Cookies

You can control or delete cookies through your browser settings. Disabling strictly necessary cookies will impair Platform functionality and may prevent you from completing phpgroup Login or transactions. phpgroup does not use third-party advertising cookies or cross-site tracking cookies that share data with external advertising networks.

phpgroup may send you marketing communications (including promotional offers, VIP programme updates, new game announcements, and bonus notifications) via email or Philippine mobile number (SMS or push notification) where you have provided your consent to receive such communications during or after Account registration.

You may withdraw your consent to marketing communications at any time by:

• Clicking the unsubscribe link included in any phpgroup marketing email;
• Updating your communication preferences in your phpgroup Account settings;
• Contacting phpgroup Support via live chat with your unsubscribe request.

Withdrawal of consent to marketing communications does not affect the lawfulness of processing carried out before withdrawal, and will not affect your receipt of transactional communications necessary for the operation of your Account (such as deposit confirmations and withdrawal notifications).

phpgroup enforces mandatory age verification as part of the Account registration and KYC process. Where phpgroup discovers or has reasonable grounds to believe that a person under 21 has provided personal data through the Platform, phpgroup will take immediate steps to close the associated Account, delete the minor's personal data to the extent permitted by applicable law, and refund any deposits made.

Parents and guardians who become aware that a minor has provided personal data to phpgroup should contact Support immediately using the contact details in Section 16.

Under the Data Privacy Act of 2012 and applicable Philippine regulations, you have the following rights in respect of your personal data held by phpgroup:

13.1 Right to Be Informed

You have the right to be informed of the fact of processing of your personal data, the purposes for which it is processed, and your other rights under applicable law. This Privacy Policy satisfies phpgroup's obligation to inform you.

13.2 Right of Access

You have the right to request a copy of the personal data phpgroup holds about you, along with information about how it is processed.

13.3 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data phpgroup holds about you. For basic Account information, you may update many details directly in your phpgroup Account settings.

13.4 Right to Erasure

You may request deletion of personal data phpgroup holds about you where it is no longer necessary for the purposes for which it was collected. Note that phpgroup may be required to retain certain data to comply with legal obligations (such as AML record-keeping requirements) notwithstanding an erasure request.

13.5 Right to Object

You have the right to object to the processing of your personal data for marketing purposes at any time and at no cost.

13.6 Right to Data Portability

You have the right to receive a copy of personal data you have provided to phpgroup in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller where technically feasible.

13.7 Exercising Your Rights

To exercise any of the above rights, please contact phpgroup's Data Protection Officer using the contact details provided in Section 16. phpgroup will respond to rights requests within 30 calendar days of receipt. Verification of identity may be required before phpgroup processes a rights request.

If you are not satisfied with phpgroup's response to a data privacy concern or rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the supervisory authority responsible for overseeing compliance with the Data Privacy Act of 2012 in the Philippines.

phpgroup encourages Players to contact phpgroup's DPO directly in the first instance to attempt resolution of any privacy concern before escalating to a regulatory body, as many concerns can be resolved efficiently through direct communication.

phpgroup reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or phpgroup's data processing practices. The current version of this Policy will always be accessible at phpgroup.one/privacy-policy.

Where phpgroup makes material changes to this Policy that affect your rights or the way your personal data is processed, phpgroup will notify you by email to your registered address and/or by a prominent notice on the phpgroup Platform prior to the changes taking effect. Continued use of the phpgroup Platform after notification constitutes your acceptance of the revised Policy.

The "Last updated" date at the top of this document indicates when the most recent revision was made.

For any questions, concerns, or requests regarding this Privacy Policy or phpgroup's data processing practices, please contact us through any of the following channels:

• Live Chat: Available 24/7 via the phpgroup Platform — the fastest route for most Privacy enquiries;
• Email: The phpgroup support email address is displayed in plain text in the footer of every page on phpgroup.one;
• Data Protection Officer: For formal data rights requests or DPO-specific correspondence, address your communication to the Data Protection Officer at the support email address with the subject line "Data Privacy Request".

phpgroup aims to acknowledge all Privacy-related enquiries within 24 hours and to provide a substantive response within 30 calendar days. For complex rights requests requiring significant data retrieval or legal review, phpgroup may extend this period by a further 30 days with prior notice to you.