phatay Privacy
Policy

01 Introduction

phatay ("phatay," "we," "us," or "our") is committed to protecting the privacy and personal data of all users ("you," "Player," or "User") of the phatay online casino platform accessible at phatay.app (the "Platform"). This Privacy Policy has been prepared in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all personal data collected by phatay through the Platform, including data collected during account registration, KYC verification, gameplay, financial transactions, customer support interactions, and any other use of phatay's services. It also applies to data collected through phatay's mobile applications, promotional communications, and any other digital touchpoints operated by phatay.

This Privacy Policy should be read together with phatay's Terms & Conditions and Responsible Gaming Policy, both of which are available on the Platform. By using phatay, you consent to the data practices described in this Privacy Policy.

phatay has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. Contact details for the DPO are provided in Section 14 of this document.

02 Data We Collect

phatay collects the following categories of personal data from users of the Platform:

phatay does not collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. We do not collect data relating to racial or ethnic origin, political opinions, religious beliefs, or health information unless directly relevant to a responsible gaming assessment conducted at your request.

03 How We Collect Your Data

phatay collects personal data through the following means:

• Direct submission — Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection — Technical data collected automatically when you access the Platform, including IP addresses, device identifiers, browser information, and session activity logs collected through cookies and similar tracking technologies.
• Third-party sources — Identity verification data from KYC service providers; fraud screening data from anti-fraud partners; payment verification data from GCash, PayMaya, BPI, BDO, and Metrobank; and regulatory data from PAGCOR and the Anti-Money Laundering Council (AMLC) where required by law.
• Gameplay activity — Data generated automatically through your use of phatay games, including bet amounts, game outcomes, session durations, and responsible gaming tool usage.

All data collection by phatay is conducted on a lawful basis as described in Section 5 of this Privacy Policy. phatay does not collect personal data through deceptive or covert means.

04 How We Use Your Data

phatay uses your personal data for the following purposes:

• Account management — To create, maintain, and manage your phatay player account, including authentication and access control.
• KYC and age verification — To verify your identity and confirm that you meet the 21+ age requirement mandated by Philippine law and PAGCOR regulations before allowing deposits or withdrawals.
• Payment processing — To process deposits and withdrawals through your registered payment methods (GCash, PayMaya, BPI, BDO, Metrobank) and to maintain accurate financial records.
• Regulatory compliance — To fulfill phatay's obligations under PAGCOR licensing conditions, the Philippine Anti-Money Laundering Act (AMLA), and other applicable Philippine laws and regulations.
• Fraud prevention and security — To detect, investigate, and prevent fraudulent activity, money laundering, account takeovers, and other security threats to the Platform and its users.
• Responsible gaming — To monitor gameplay patterns for signs of problem gambling, to administer self-exclusion and deposit limit tools, and to comply with PAGCOR's responsible gaming requirements.
• Customer support — To respond to your inquiries, resolve disputes, and provide technical assistance.
• Platform improvement — To analyze aggregate usage data and improve the performance, features, and user experience of the phatay Platform.
• Marketing communications — To send you promotional offers, bonus notifications, and platform updates, where you have provided consent to receive such communications. You may opt out at any time.
• Legal proceedings — To establish, exercise, or defend legal claims involving phatay or its users.

phatay will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

05 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phatay processes your personal data on the following legal bases:

• Contractual necessity — Processing is necessary to perform the contract between you and phatay (i.e., the Terms & Conditions), including account management, payment processing, and game provision.
• Legal obligation — Processing is required to comply with phatay's legal obligations under PAGCOR regulations, the AMLA, the Data Privacy Act, and other applicable Philippine laws.
• Legitimate interests — Processing is necessary for phatay's legitimate interests in fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights and freedoms.
• Consent — For marketing communications and non-essential cookies, phatay relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

06 Data Sharing & Disclosure

phatay does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your personal data may be shared with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

• KYC and identity verification providers — Third-party service providers that assist phatay in verifying the identity and age of players as required by PAGCOR regulations.
• Payment processors — GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers necessary to process your deposits and withdrawals.
• Fraud prevention and security partners — Specialist providers that assist phatay in detecting and preventing fraudulent activity, money laundering, and other security threats.
• Game content providers — Licensed game studios and software providers whose games are available on the phatay Platform, to the extent necessary for game integrity and dispute resolution.
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law or regulatory directive.
• Legal and professional advisors — Lawyers, accountants, and other professional advisors engaged by phatay in connection with legal proceedings or compliance matters, subject to professional confidentiality obligations.
• Business successors — In the event of a merger, acquisition, or sale of phatay's business, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party service providers engaged by phatay are required to process your personal data only on phatay's instructions and in accordance with applicable data protection laws. phatay maintains data processing agreements with all relevant third-party processors.

07 Data Retention

phatay retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Account and identity data — Retained for the duration of your account and for a minimum of five (5) years after account closure, as required by PAGCOR licensing conditions and AMLA regulations.
• KYC verification documents — Retained for a minimum of five (5) years from the date of submission, in compliance with AMLA record-keeping requirements.
• Financial transaction records — Retained for a minimum of five (5) years from the date of each transaction, as required by AMLA and PAGCOR regulations.
• Gaming activity records — Retained for a minimum of three (3) years from the date of each gaming session, for dispute resolution and regulatory audit purposes.
• Customer support communications — Retained for two (2) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records — Retained for the duration of your consent and for one (1) year after withdrawal of consent, to demonstrate compliance.

Upon expiry of the applicable retention period, phatay will securely delete or anonymize your personal data in accordance with its data disposal procedures. Where data cannot be immediately deleted due to technical constraints, it will be isolated and protected from further processing until deletion is possible.

08 Data Security

phatay implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in transit — All data transmitted between your device and phatay's servers is encrypted using TLS 1.3 (Transport Layer Security) protocol.
• Encryption at rest — Sensitive personal data stored on phatay's servers, including KYC documents and payment details, is encrypted using AES-256 encryption.
• Access controls — Access to personal data is restricted to phatay personnel and authorized service providers who have a legitimate need to access it. All access is logged and audited.
• Multi-factor authentication — phatay's internal systems require multi-factor authentication for all personnel accessing personal data.
• Regular security audits — phatay conducts regular penetration testing and security audits of its Platform and data infrastructure.
• Incident response — phatay maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, phatay will notify the National Privacy Commission and affected players within the timeframes required by the Data Privacy Act.

While phatay takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your phatay account credentials and for notifying phatay immediately if you suspect unauthorized access to your account.

09 Cookies & Tracking Technologies

phatay uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain session security, and analyze aggregate platform performance. The following types of cookies are used by phatay:

• Strictly necessary cookies — Essential for the Platform to function correctly. These cookies enable core features such as session management, login authentication, and security. They cannot be disabled without affecting Platform functionality.
• Functional cookies — Used to remember your preferences and settings (such as language and display preferences) to provide a more personalized experience.
• Analytics cookies — Used to collect aggregate, anonymized data about how users interact with the Platform, helping phatay identify areas for improvement. No personally identifiable information is collected through analytics cookies.
• Security cookies — Used to detect and prevent fraudulent activity, bot traffic, and unauthorized access attempts.

phatay does not use advertising or cross-site tracking cookies. You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may affect your ability to use certain features of the Platform.

phatay's Platform may use session storage and local storage technologies in addition to cookies, for the same purposes described above. These technologies store data locally on your device and are subject to the same principles as cookies under this Privacy Policy.

10 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phatay:

To exercise any of the above rights, please contact phatay's Data Protection Officer using the contact details provided in Section 14. phatay will respond to all data subject requests within fifteen (15) business days of receipt. In complex cases, this period may be extended by a further fifteen (15) business days, with prior notice to you.

phatay may request proof of identity before processing a data subject request to ensure that personal data is not disclosed to unauthorized parties.

11 Children's Privacy

The phatay Platform is strictly intended for adults aged 21 years and older. phatay does not knowingly collect personal data from individuals under the age of 21. The 21+ age requirement is the minimum legal age for participation in casino-style gambling in the Philippines as prescribed under applicable Philippine law and PAGCOR regulations.

All players are required to complete KYC age verification before making any deposit or withdrawal. If phatay discovers that personal data has been collected from a person under the age of 21, that account will be immediately suspended, all funds will be frozen pending investigation, and the matter will be reported to PAGCOR and relevant Philippine authorities as required by law.

If you are a parent or guardian and believe that a minor has registered on the phatay Platform, please contact our support team immediately at the contact details provided in Section 14. phatay takes underage gambling extremely seriously and will act promptly on all such reports.

12 Cross-Border Data Transfers

phatay's primary data processing infrastructure is located within the Philippines. However, some of phatay's third-party service providers — including KYC verification providers, fraud prevention partners, and game content providers — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, phatay ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act of 2012 and NPC guidelines. These safeguards include:

• Data processing agreements with all third-party processors that impose data protection obligations equivalent to those under Philippine law
• Transfer only to jurisdictions that the NPC has recognized as providing an adequate level of data protection
• Implementation of standard contractual cla uses where transfers are made to jurisdictions without an adequacy determination

By using the phatay Platform, you acknowledge and consent to the transfer of your personal data to third-party service providers outside the Philippines where necessary for the provision of phatay's services, subject to the safeguards described above.

13 Changes to This Privacy Policy

phatay reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or phatay's data processing practices. The updated Privacy Policy will be posted on the Platform with a revised "Last Updated" date at the top of the document.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way phatay processes your personal data — phatay will notify you by email to your registered address or by a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

Your continued use of the phatay Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Privacy Policy, you must stop using the Platform and may request account closure by contacting phatay's customer support team.

phatay encourages you to review this Privacy Policy periodically to stay informed about how your personal data is being protected. Archived versions of previous Privacy Policies are available upon request from the Data Protection Officer.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or phatay's data processing practices, please contact phatay's Data Protection Officer using the details below:

If you are not satisfied with phatay's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

phatay is committed to resolving all data privacy concerns promptly and transparently. We encourage you to contact our Data Protection Officer in the first instance before escalating a complaint to the NPC, as most concerns can be resolved directly and efficiently through our internal process.