phtatya Privacy Policy

phtatya is a PAGCOR-regulated online gaming platform operating at phtatya.net, providing Filipino players with access to JILI slots, live dealer casino games, Color Game, Fortune Dragon, Bingo, and other gaming products. For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), phtatya acts as the Personal Information Controller (PIC) in respect of all personal data collected through the Platform.

As a PIC, phtatya determines the purposes and means of processing your personal data and is fully accountable for ensuring that all data processing activities conducted through the Platform comply with the requirements of RA 10173, its Implementing Rules and Regulations, and any relevant issuances from the National Privacy Commission (NPC) of the Philippines.

phtatya operates exclusively in compliance with PAGCOR licensing requirements. Our commitment to data privacy is not merely a legal obligation — it is a fundamental part of our promise to every Filipino player from Manila to Cebu, Davao to Quezon City, and everywhere in between.

phtatya collects personal data only to the extent necessary to provide a safe, compliant, and enjoyable gaming experience. The categories of personal data we collect are described below:

phtatya does not intentionally collect sensitive personal information (as defined under RA 10173, Section 3(l)) beyond what is strictly required for identity verification and PAGCOR compliance. Where sensitive personal information is collected — such as government ID data during KYC — it is subject to enhanced security controls and stricter access limitations.

We do not collect personal data from individuals who merely browse the Platform without creating an account, beyond standard technical data (IP address, browser information) collected automatically for security and analytics purposes.

phtatya processes your personal data for the following specific purposes. We do not use your data for any purpose not listed here without obtaining your prior consent or as otherwise permitted by RA 10173:

• Account Management: Creating, maintaining, verifying, and securing your phtatya player account, including authentication and password recovery.
• KYC & Regulatory Compliance: Verifying your identity and age (21+ requirement) in accordance with PAGCOR licensing conditions and the Philippine Anti-Money Laundering Act (AMLA), Republic Act No. 9160 as amended.
• Payment Processing: Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other accepted payment methods; reconciling transactions; and applying return-to-source withdrawal policies.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, collusion, and other prohibited conduct on the Platform.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential problem gambling behaviours; implementing and enforcing deposit limits, cooling-off periods, and self-exclusion requests; and fulfilling PAGCOR reporting obligations in relation to self-excluded players.
• Customer Support: Responding to your queries, complaints, and support requests via live chat, email, Messenger, or Viber; maintaining records of communications for quality assurance.
• Promotional Communications: Sending you relevant bonus offers, promotions, and platform updates — but only where you have opted in to receive marketing communications. You may withdraw this consent at any time through your account settings.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players use the Platform and to improve game offerings, user interface, and performance.
• Legal Obligations: Complying with court orders, regulatory directives from PAGCOR or the NPC, and other legally mandated disclosure requirements.

Under the Philippine Data Privacy Act of 2012, phtatya processes your personal data on one or more of the following lawful bases:

• Consent (Section 12(a), RA 10173): Where you have freely given, specific, informed, and unambiguous consent to the processing — for example, by opting in to receive marketing communications or by agreeing to this Privacy Policy during registration.
• Contractual Necessity (Section 12(b), RA 10173): Where processing is necessary for the performance of the contract between you and phtatya — specifically, the Terms and Conditions you agreed to upon account registration. This covers account creation, payment processing, game access, and support services.
• Compliance with Legal Obligation (Section 12(c), RA 10173): Where processing is required to comply with a legal obligation applicable to phtatya, including PAGCOR licensing requirements, AMLA obligations, and NPC directives.
• Legitimate Interests (Section 12(f), RA 10173): Where processing is necessary for the legitimate interests of phtatya or a third party, provided those interests are not overridden by your fundamental rights and freedoms. This covers fraud prevention, Platform security, and aggregated analytics.

phtatya uses cookies and similar tracking technologies on the Platform to ensure its proper functioning, maintain your session security, and improve your overall experience. A cookie is a small text file stored on your device by your web browser when you visit a website.

The following categories of cookies are used on the phtatya Platform:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. You cannot opt out of strictly necessary cookies as they are required for the Platform to operate.
• Functional Cookies: Remember your preferences — such as language settings, responsible gaming settings, and display preferences — so you do not need to reconfigure them on each visit. These are set with your implied consent through account use.
• Analytics Cookies: Used to collect anonymised, aggregated data about how visitors interact with the Platform — pages visited, time on site, and navigation paths. This helps phtatya understand usage patterns and improve the Platform. We use only first-party analytics tools; no third-party advertising analytics cookies are deployed.
• Security Cookies: Used for fraud detection, bot identification, and unusual session activity monitoring. These are essential for maintaining Platform integrity and player account security.

Most web browsers allow you to manage or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the phtatya Platform, including your ability to log in and maintain an active gaming session.

phtatya does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data is shared only in the following limited circumstances and with appropriate data protection safeguards in place:

• Payment Processors: GCash (Mynt — Globe Fintech Innovations, Inc.), PayMaya (Maya Bank, Inc.), BPI, BDO, and Metrobank receive necessary financial data to process your deposit and withdrawal transactions. Each of these providers is subject to Bangko Sentral ng Pilipinas (BSP) regulation and their own data privacy obligations.
• Identity Verification Providers: Third-party KYC and identity verification service providers receive your identity documents and biometric data solely for the purpose of verifying your identity and age in compliance with PAGCOR requirements. These providers are bound by strict data processing agreements.
• Game Providers: Licensed game providers (including JILI and other certified providers) receive your player ID and gaming session data necessary to deliver game content and maintain game integrity. They do not receive your full personal profile or financial data.
• Regulatory Authorities: PAGCOR, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and other Philippine regulatory authorities may receive your personal data where required by law, court order, or regulatory directive.
• IT & Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data strictly on phtatya's behalf and under binding data processing agreements consistent with RA 10173 requirements.
• Professional Advisers: Legal counsel, auditors, and compliance consultants who are subject to professional obligations of confidentiality.

phtatya retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with phtatya's data disposal procedures. Anonymised data (from which no individual can be identified) may be retained indefinitely for statistical and analytical purposes.

Under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by phtatya. These rights are subject to certain limitations and exceptions as provided under RA 10173 and its Implementing Rules and Regulations.

Here is what each right means in practice:

• Right to Be Informed: You have the right to know what personal data phtatya collects about you, why it is collected, and how it is processed — which is the primary purpose of this Privacy Policy.
• Right of Access: You may request a copy of the personal data phtatya holds about you, along with information about how it is being used.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request correction. Many details can be updated directly in your account profile.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations.
• Right to Object: You may object to the processing of your personal data where phtatya relies on legitimate interests as the legal basis, or for direct marketing purposes.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Blocking or Restriction: You may request that phtatya restrict the processing of your data while a correction or objection request is being assessed.
• Right to Damages: You have the right to be indemnified for any damage sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
• Right to Complain: If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.

To exercise any of these rights, please contact phtatya's Data Protection Officer at [email protected]. We will acknowledge your request within 72 hours and aim to resolve it within 15 Philippine business days, in accordance with NPC guidelines.

phtatya implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• Encryption in Transit: All data transmitted between your device and the phtatya Platform is encrypted using TLS 1.3 (Transport Layer Security). This applies to all login sessions, payment transactions, and support communications.
• Encryption at Rest: Sensitive personal data stored in phtatya's databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to phtatya staff and service providers who have a documented need to access it for their specific role. All access is authenticated, logged, and periodically reviewed.
• Two-Factor Authentication: phtatya offers two-factor authentication (2FA) for player accounts and enforces it for all internal staff accounts with access to personal data systems.
• Regular Security Audits: phtatya's Platform and data systems are subject to regular penetration testing and vulnerability assessments conducted by qualified third-party security specialists.
• Data Breach Response: In the event of a personal data breach that is likely to result in harm to affected individuals, phtatya will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, as required by RA 10173 and NPC Circular No. 16-03.

While phtatya takes all reasonable and proportionate measures to protect your data, no online platform can guarantee absolute security. You also have an important role to play — keep your account credentials confidential, use a strong unique password, and enable 2FA on your phtatya account.

phtatya is strictly intended for individuals who are 21 years of age or older. 21+ This age restriction is mandated by PAGCOR regulations governing online casino gaming in the Philippines and is a fundamental condition of the phtatya Platform's operating licence.

phtatya does not knowingly collect personal data from any individual under the age of 21. If during the registration or KYC process we determine that an applicant is under 21 years of age, the account registration will be declined and any personal data collected in connection with that application will be securely deleted within 30 days, except where retention is required to comply with a legal obligation.

If you are a parent or guardian and you believe that a minor under your care has registered an account on the phtatya Platform or has submitted personal data to phtatya, please contact our Data Protection Officer immediately at [email protected]. We will investigate promptly, close the account if confirmed, and securely delete the minor's personal data.

phtatya may update this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements from the National Privacy Commission or PAGCOR, changes in the services we offer, or other operational developments.

The effective date of the current version of this Privacy Policy is displayed at the top of this page. Where changes are material — for example, changes to the categories of data we collect, new third-party data-sharing arrangements, or changes to your rights — we will notify you by email to the address registered to your phtatya account at least fourteen (14) days before the changes take effect.

For non-material changes (such as typographical corrections, clarifications of existing practice, or changes required immediately by law), the updated Policy may take effect upon publication without advance notice.

Continued use of the phtatya Platform after the effective date of any update constitutes your acknowledgement of the revised Privacy Policy. We encourage you to review this page periodically to stay informed about how phtatya protects your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way phtatya handles your personal data, you are encouraged to contact us through the following channels. Our Data Protection Officer is available to assist you Monday through Friday, 9:00 AM – 6:00 PM PHT, with urgent data breach or security matters handled 24/7 through our support team.

• Email (DPO): [email protected] — Please include "Privacy Request" or "DPO Inquiry" in your subject line for faster routing.
• Live Chat: Available 24 hours a day, 7 days a week via the phtatya Platform. Average response time: 3–5 minutes.
• Messenger / Viber: Available 8:00 AM – 12:00 AM PHT.

phtatya will acknowledge all privacy-related requests within 72 hours and provide a substantive response within 15 Philippine business days. Complex requests may require additional time, in which case we will keep you informed of progress.

If you are not satisfied with phtatya's response to your privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines — the independent regulatory body responsible for enforcing RA 10173. The NPC can be reached through their official website and accepts formal complaints from Philippine data subjects.