ph28com Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how ph28com ("ph28com", "we", "us", "our") — the operator of the online gaming platform accessible at ph28com.app — collects, uses, stores, shares, and protects the personal data of users ("Player", "you", "your") who access or use our services.

ph28com is committed to protecting the privacy and personal data of all Filipino players who trust our platform. This Policy is written in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects ph28com's obligations under our PAGCOR operating licence.

By registering an account, making a deposit, or otherwise using the ph28com platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy. If you do not agree, please discontinue use of the platform and contact us to arrange account closure.

2. Data Controller

ph28com is the personal information controller (PIC) as defined under Section 3(h) of the Data Privacy Act of 2012. ph28com determines the purposes and means of processing the personal data you provide when you use the ph28com platform. All enquiries relating to data privacy should be directed to our designated Data Protection Officer (DPO) using the contact details in Section 13 of this Policy.

3. Personal Data We Collect

ph28com collects personal data through several channels: directly from you at registration and during your use of the platform; automatically through technical systems; and, in limited cases, from third-party sources for identity verification purposes. The categories of personal data we process are as follows:

3.1 Registration & Identity Data

3.2 Financial & Transaction Data

When you make deposits or request withdrawals, ph28com collects transaction data necessary to process payments via GCash, PayMaya, BPI, BDO, Metrobank, InstaPay, and PESONet. This includes transaction reference numbers, payment method identifiers (e.g. GCash mobile number), transaction amounts in Philippine Pesos (PHP), timestamps, and deposit or withdrawal status. ph28com does not store full bank account numbers or card numbers on our servers.

3.3 Gaming & Platform Activity Data

ph28com records gameplay data to ensure fair play, resolve disputes, and meet PAGCOR reporting obligations. This includes game session records, bet amounts and outcomes, bonus redemption history, login timestamps, and responsible gaming tool settings such as deposit limits and self-exclusion status.

3.4 Technical & Device Data

When you access ph28com, our servers automatically log technical information including your IP address, device type, operating system, browser type and version, screen resolution, and referring URL. This data is used for security monitoring, fraud detection, and platform performance optimization.

3.5 Communications Data

If you contact ph28com via live chat, email, or any other support channel, we retain records of those communications — including the content of messages, timestamps, and case resolution status — for quality assurance and regulatory audit purposes.

4. Purpose & Legal Basis for Processing

ph28com processes your personal data only when there is a lawful basis to do so under the Data Privacy Act of 2012. The following table outlines the primary purposes for which we process your data and the corresponding legal basis under the DPA:

5. Data Sharing & Disclosure

ph28com does not sell, rent, or trade your personal data to any third party. We may share your data with the following categories of recipients only to the extent necessary and only under strict data processing agreements or legal obligations:

• Payment processors and e-wallet providers — GCash (G-Xchange, Inc.), PayMaya/Maya, BPI, BDO, Metrobank, InstaPay network members, and PESONet participants, solely to execute your deposit and withdrawal instructions.
• Identity verification providers — Third-party KYC service providers that assist ph28com in verifying government-issued IDs and conducting AML screening in compliance with PAGCOR and AMLC requirements.
• PAGCOR — The Philippine Amusement and Gaming Corporation, as our licensing authority, may require ph28com to submit player data, transaction records, or gaming activity reports as part of regulatory audits or investigations.
• Anti-Money Laundering Council (AMLC) — ph28com is legally required to file covered transaction reports (CTRs) and suspicious transaction reports (STRs) with the AMLC in accordance with RA 9160 and its amendments.
• Law enforcement and courts — ph28com will disclose personal data in response to a valid subpoena, court order, or lawful request from Philippine law enforcement authorities.
• IT infrastructure and cloud service providers — Providers of hosting, database, and security services who process data on ph28com's behalf under binding data processing agreements that require GDPR-equivalent protections.

6. Data Retention

ph28com retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine laws and PAGCOR regulations. The following retention periods apply:

Upon expiry of the applicable retention period, ph28com will securely delete or anonymise your personal data in a manner that prevents reconstruction or re-identification.

7. Security Measures

ph28com implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• TLS 1.3 encryption for all data in transit between your device and ph28com servers.
• AES-256 encryption for sensitive data fields stored in our databases.
• Bcrypt password hashing — your account password is never stored in plain text.
• Two-factor authentication (2FA) available for all ph28com accounts via SMS OTP or authenticator app.
• Role-based access controls (RBAC) ensuring that ph28com staff can only access player data that is necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent security firms.
• 24/7 intrusion detection and anomaly monitoring on all production infrastructure.
• Physical security controls at the data centre facilities hosting ph28com's servers, including biometric access, CCTV monitoring, and fire suppression systems.

8. Cookies & Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device by your browser when you visit a website. ph28com uses cookies and similar technologies (such as local storage and session tokens) to operate the platform, maintain your login session, and improve your experience.

8.2 Types of Cookies We Use

ph28com does not use third-party advertising or retargeting cookies. You may manage or delete cookies at any time through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to your ph28com account.

9. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph28com. To exercise any of these rights, submit a written request to our Data Protection Officer using the contact details in Section 13. ph28com will respond within 15 business days of receiving a verified request.

• Right to be Informed — You have the right to be informed whether ph28com holds personal data about you and how that data is being processed.
• Right to Access — You may request a copy of the personal data ph28com holds about you, together with information about how it is used and with whom it is shared.
• Right to Correction — If any personal data ph28com holds about you is inaccurate, incomplete, or outdated, you have the right to request correction.
• Right to Erasure ("Right to be Forgotten") — You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to ph28com's legal retention obligations under PAGCOR regulations and the AMLA.
• Right to Data Portability — You may request that ph28com provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object — You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where you believe your rights and freedoms override those interests.
• Right to Damages — If you suffer harm as a result of ph28com's violation of the Data Privacy Act, you may be entitled to claim compensation from ph28com.

10. Minors & Age Restriction

The ph28com platform is strictly intended for adults aged 21 years and above, as mandated by PAGCOR regulations governing online gaming in the Philippines. ph28com does not knowingly collect, process, or store the personal data of any person under the age of 21.

All new registrations are subject to mandatory age verification. If ph28com discovers or has reasonable grounds to believe that a registered user is under 21 years of age, the account will be immediately suspended, access to all real-money features will be revoked, and all personal data associated with that account will be securely deleted in accordance with PAGCOR guidelines, except where retention is required for legal or regulatory purposes.

11. Cross-Border Data Transfers

ph28com primarily processes and stores player data within the Republic of the Philippines. In limited circumstances, data may be transferred to or accessed from servers located outside the Philippines — for example, where ph28com engages cloud infrastructure providers whose facilities span multiple geographic regions.

Any cross-border transfer of personal data is subject to appropriate safeguards as required by Section 21 of the Data Privacy Act of 2012 and NPC Circular No. 2022-04. These safeguards include binding contractual clauses that require recipient entities to protect personal data to a standard at least equivalent to that required by Philippine law. ph28com will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing additional technical and contractual safeguards.

12. Changes to This Privacy Policy

ph28com reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where changes are material — meaning they affect how we use your personal data in a way that was not previously disclosed — ph28com will notify you by email to the address registered on your account, or via a prominent notice on the platform, at least 7 days before the amended Policy takes effect.

The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the ph28com platform after the effective date of any amended Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy , please discontinue use of the platform and contact us to arrange account closure.

13. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a privacy concern, please contact our Data Protection Officer using the details below. All requests must be submitted in writing and will be acknowledged within 5 business days.

If you are not satisfied with ph28com's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC accepts complaints from data subjects whose rights under the Data Privacy Act of 2012 have been violated.

ph28com takes all privacy complaints seriously. We are committed to resolving concerns fairly, transparently, and in accordance with the Data Privacy Act of 2012 and all applicable NPC issuances.