phfund Privacy Policy

1 Introduction & Scope

phfund operates an online gaming platform under license from the Philippine Amusement and Gaming Corporation (PAGCOR), serving Filipino players aged 21 and above across the Philippines. In the course of providing gaming, payment, support, and promotional services, phfund necessarily collects and processes personal information about its players and website visitors.

This Policy applies to all personal data processed by phfund through: the phfund website and web application; the phfund mobile application; live chat and email support communications; social media interactions managed by phfund; and any other phfund-controlled digital channel. It does not apply to third-party websites or services that may be linked from the phfund platform, including but not limited to payment processor portals and game provider platforms. Players should review the privacy policies of those third parties independently.

2 Data Controller

phfund acts as the personal information controller (PIC) for all personal data collected through the platform, as defined under Republic Act 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations. phfund has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance and handling data subject requests.

You may contact phfund's Data Protection Officer through the support channels described in Section 14 of this Policy. All data subject rights requests are handled by the DPO in accordance with the timelines and procedures prescribed by the National Privacy Commission.

3 Data We Collect

3.1 Data Provided Directly by You

phfund collects the following categories of personal data that you provide directly during registration, verification, or use of the platform:

3.2 Data Collected Automatically

When you access the phfund platform, we automatically collect certain technical and behavioral data, including:

• IP address and approximate geographic location (city/province level);
• Device type, operating system version, and browser type;
• Session timestamps, login/logout times, and session duration;
• Pages visited, features accessed, and navigation paths within the platform;
• Referring URL (if you accessed phfund from a link elsewhere);
• Cookies and similar tracking technologies as described in Section 8.

3.3 Data from Third Parties

phfund may receive limited personal data from third-party sources in connection with fraud prevention, identity verification, and payment processing. This includes verification status responses from KYC service providers, transaction confirmation data from payment processors (GCash, Maya, BPI, BDO, Metrobank), and risk signals from fraud detection services. phfund does not receive your full financial account details from these processors.

4 Purpose & Legal Basis for Processing

phfund processes personal data only for specified, legitimate purposes. The table below sets out the primary processing purposes and the corresponding legal basis under the Data Privacy Act of 2012:

5 Data Sharing & Third-Party Disclosure

5.1 Service Providers

phfund shares personal data with carefully selected third-party service providers who assist in operating the platform. These providers are contractually bound to process your data only on phfund's instructions and in accordance with appropriate data protection standards. Categories of service providers include: payment processors (GCash/GXI, Paymaya/PLDT, BancNet, and major Philippine banks); KYC and identity verification service providers; cloud infrastructure and hosting providers; fraud detection and cybersecurity service providers; live dealer game technology providers including Playtech; and customer support platform operators.

5.2 Regulatory and Law Enforcement Disclosure

phfund is required by law to disclose certain player data to Philippine regulatory and law enforcement authorities. This includes: mandatory transaction reporting to PAGCOR; covered and suspicious transaction reports to the Anti-Money Laundering Council (AMLC) under RA 9160; responses to valid court orders, subpoenas, or government directives; and cooperation with the National Privacy Commission in the event of a data breach or formal investigation.

5.3 No Sale of Personal Data

phfund does not sell, rent, trade, or otherwise commercially transfer your personal data to any third party for their independent marketing or commercial use. Any data sharing arrangement with third parties is governed by a data sharing agreement or data processing agreement, as applicable under the Data Privacy Act.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets involving phfund, personal data held by phfund may be transferred as part of that transaction. phfund will provide reasonable prior notice to affected players before any such transfer and will ensure that the recipient entity maintains data protection standards equivalent to or exceeding those in this Policy.

6 Data Retention

phfund retains personal data for as long as necessary to fulfill the purposes described in this Policy and to comply with applicable legal obligations. The following retention guidelines apply:

• Account and identity data: Retained for the duration of the account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act.
• Gaming session data: Retained for a minimum of two (2) years for dispute resolution and auditing purposes.
• Support communications: Retained for two (2) years from the date of last interaction, or longer if subject to an ongoing dispute or investigation.
• Marketing data (opted-in players): Retained until consent is withdrawn or the account is closed, whichever occurs first.
• Anonymized/aggregated analytics data: May be retained indefinitely as it cannot be used to identify individual players.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with phfund's data destruction procedures.

7 Security Measures

phfund implements appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, destruction, or accidental loss. Key measures include:

• Encryption in transit: All data transmitted between your device and phfund servers is encrypted using TLS/SSL with a minimum of 256-bit encryption. This applies to all account activity, payment processing, and API communications.
• Encryption at rest: Sensitive data fields including password hashes, ID document data, and financial reference numbers are stored using industry-standard encryption at rest.
• Access controls: Access to personal data within phfund is restricted on a strict need-to-know basis. Staff access is role-based and subject to access logging and periodic review.
• Two-factor authentication: phfund supports two-factor authentication (2FA) for player accounts and enforces it for all staff accounts with access to sensitive systems.
• Penetration testing: phfund's systems are subject to periodic security assessments and penetration testing by qualified third-party security professionals.
• Data breach response: phfund maintains a documented data breach response procedure. In the event of a breach affecting personal data, phfund will notify the National Privacy Commission within 72 hours of discovery, and affected players within a reasonable period, in accordance with NPC Circular 16-03.

8 Cookies & Tracking Technologies

8.1 Types of Cookies Used

phfund uses the following categories of cookies and similar technologies on its platform:

• Strictly necessary cookies: Required for the platform to function. These enable session management, login state, security tokens, and load balancing. They cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming limit configurations. These improve your experience but are not essential.
• Analytics cookies: Collect anonymized data about how players use the platform — which pages are visited most, where users encounter errors, and how sessions flow. This data helps phfund improve the platform experience. Analytics data is aggregated and does not identify individual players.
• Fraud prevention tokens: Short-lived session identifiers and device fingerprinting signals used to detect suspicious login attempts and protect account integrity.

8.2 Cookie Management

You may manage non-essential cookies through the phfund cookie preference center, accessible from the platform footer. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will impair or prevent your use of the phfund platform. phfund does not use third-party advertising cookies or behavioral tracking cookies for the purpose of serving targeted advertising.

9 Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, you hold the following rights with respect to your personal data held by phfund. To exercise any of these rights, contact phfund's Data Protection Officer through the channels described in Section 14.

phfund will respond to data subject rights requests within thirty (30) calendar days of receipt. Complex requests may require up to an additional thirty (30) days, of which you will be informed in advance.

10 Minors & Age Policy

The phfund platform is strictly for adults aged 21 years and above, in compliance with Philippine gaming regulations. phfund does not knowingly collect personal data from individuals under the age of 21. Age is verified during the KYC process using valid Philippine government-issued identification.

If phfund discovers that personal data has been collected from an individual under the age of 21 — whether through misrepresentation during registration or any other means — the account will be immediately suspended, all personal data associated with that account will be reviewed, and any funds will be processed for return in accordance with applicable procedures. phfund may report such instances to PAGCOR.

Parents and guardians are encouraged to maintain oversight of their household's digital activity. If you believe a minor has accessed or registered on the phfund platform, please contact support immediately via live chat or email.

11 Marketing Communications

phfund may send promotional content — including bonus offers, new game announcements, tournament notifications, and platform updates — to registered players who have opted in to marketing communications during registration or through account settings.

phfund uses the following channels for marketing communications: SMS to your registered Philippine mobile number; email to your registered email address; and push notifications within the phfund mobile app (if enabled on your device).

You may withdraw consent to marketing communications at any time by: updating your notification preferences in account settings; clicking the unsubscribe link included in all phfund marketing emails; replying STOP to any phfund SMS communication; or contacting phfund support to request removal from marketing lists. Withdrawal of marketing consent does not affect your ability to receive service-essential communications such as transaction confirmations, security alerts, and account notifications.

12 Cross-Border Data Transfers

Some of phfund's third-party service providers operate infrastructure or personnel outside of the Philippines. Where personal data is transferred outside Philippine territory, phfund implements appropriate safeguards to ensure that your data remains protected to a standard equivalent to the Data Privacy Act of 2012. These safeguards include data processing agreements incorporating standard contractual clauses recognized by the National Privacy Commission, and transfers only to jurisdictions or entities that have been assessed as providing adequate protection for personal data.

phfund does not transfer personal data outside the Philippines for purposes of commercial data trading. Cross-border transfers are limited to service delivery functions such as cloud hosting, live dealer game infrastructure, and fraud detection services.

13 Policy Updates

phfund reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, PAGCOR regulatory requirements, or National Privacy Commission guidance. The effective date displayed at the top of this Policy indicates when the current version took effect.

Material changes to this Policy — those that significantly affect how your personal data is processed or that reduce your rights — will be communicated to you via email to your registered address at least fourteen (14) days before they take effect. Non-material updates, such as clarifications or editorial corrections, may take effect immediately upon publication without individual notification.

Your continued use of the phfund platform after the effective date of any revised Policy constitutes acceptance of those changes. If you do not agree with the revised Policy, you must cease using phfund and request account closure before the effective date of the changes.

14 Contact the Data Protection Officer

For all matters relating to this Privacy Policy, your personal data held by phfund, or the exercise of your data subject rights, you may contact phfund's Data Protection Officer through the following channels:

• Live Chat: Available 24/7 directly from your phfund account dashboard after login. Select "Privacy / Data Request" as the inquiry type.
• Email: [email protected] — Please use the subject line "Data Privacy Request" and include your registered account mobile number or email for verification. Responses are provided within 30 calendar days.