ph859 Privacy
Policy

1Introduction

ph859 takes the privacy and security of your personal data seriously. This Privacy Policy describes our practices regarding the personal information of users ("you", "Player", "Data Subject") who register, access, or otherwise interact with ph859 through ph859.org or any associated platform features.

ph859 operates as a PAGCOR-regulated online gaming platform in the Philippines and is subject to both the regulatory requirements of the Philippine Amusement and Gaming Corporation (PAGCOR) and the data protection obligations imposed by the Data Privacy Act of 2012 (RA 10173), the Cybercrime Prevention Act of 2012 (RA 10175), the Anti-Money Laundering Act (RA 9160, as amended), and other applicable Philippine statutes and regulations.

This policy applies to all personal data collected by ph859 in connection with account registration, KYC verification, financial transactions, gaming activity, customer support interactions, and marketing communications. It applies to data collected through the ph859 website, mobile browser interface, and any other channel through which Players interact with ph859.

2Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, ph859 acts as the Personal Information Controller (PIC) in respect of all personal data collected from Players through the ph859 platform. ph859 determines the purposes and means of processing personal data collected through its services.

Where ph859 engages third-party service providers (such as payment processors, game software providers, or identity verification services) who process personal data on ph859's behalf, such providers act as Personal Information Processors (PIPs) under binding contractual arrangements that require them to process personal data only on ph859's instructions and to maintain appropriate security standards consistent with RA 10173.

The ph859 Data Protection Officer (DPO) is responsible for overseeing compliance with this Privacy Policy and all applicable data protection laws. Inquiries addressed to the DPO may be directed to: [email protected] with the subject line "Data Protection Inquiry".

3Personal Data We Collect

ph859 collects the following categories of personal data from Players, to the extent necessary for the purposes described in Section 5:

3.1 Registration & Identity Data

• Full legal name as it appears on a government-issued Philippine ID
• Date of birth (for age verification — minimum 21 years)
• Registered Philippine mobile number
• Email address
• Home address or billing address
• Username and encrypted password

3.2 KYC & Identity Verification Data

• Government-issued Philippine ID type and number (PhilSys ID, UMID, passport, driver's license, PRC ID, or equivalent)
• ID document images or scanned copies as submitted during verification
• Selfie or liveness-check images where required for enhanced verification

3.3 Financial & Transaction Data

• Deposit records including amount, date, time, and payment method
• Withdrawal records including amount, destination method, and processing status
• GCash or PayMaya account reference numbers (not full mobile wallet credentials)
• Bank account details (name, bank, account number) where provided for bank transfer withdrawals
• Transaction reference numbers and payment gateway identifiers

3.4 Gaming & Account Activity Data

• Game session records: game title, wager amounts, game outcomes, session duration
• Login history: date, time, IP address, and device type for each login session
• Bonus and promotion activity records
• Responsible gaming settings: active deposit limits, cooling-off periods, self-exclusion status
• Customer support communication records

3.5 Technical & Device Data

• IP address at time of registration and login
• Device type, operating system version, and browser type
• Session cookies and authentication tokens
• Platform usage analytics (pages visited, time spent, click patterns) in aggregated and/or anonymized form

4How We Collect Your Data

ph859 collects personal data through the following channels and methods:

• Directly from you: When you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or update your account settings.
• Automatically through platform use: When you log in, navigate the platform, play games, or access features, technical data is collected automatically through server logs, session cookies, and analytics systems.
• From payment service providers: When you initiate a GCash, PayMaya, or bank transfer transaction, the payment provider transmits confirmation and reference data to ph859 to facilitate wallet crediting and withdrawal processing.
• From identity verification services: Where ph859 uses third-party KYC technology providers for document verification or liveness checks, those providers transmit verification results and associated data to ph859.
• From PAGCOR and regulatory sources: In connection with PAGCOR's regulatory oversight, ph859 may receive data about Players from PAGCOR or other regulatory bodies as permitted or required by law.

5Purpose & Legal Basis for Processing

ph859 processes personal data only where there is a lawful basis for doing so under RA 10173. The following table summarizes the primary purposes for which personal data is processed and the corresponding legal basis:

6Cookies & Tracking Technologies

ph859 uses cookies and similar tracking technologies to enable platform functionality, maintain authenticated sessions, support fraud detection, and analyse aggregate platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential to the functioning of ph859. They enable you to log in, maintain a session, and use basic platform features. These cookies cannot be disabled without affecting the functionality of the platform.
• Security Cookies: Used to support fraud detection, session integrity verification, and protection against unauthorized account access attempts.
• Analytics Cookies: Used to collect aggregated and anonymized data about how Players navigate and use ph859. This data is used to improve the platform's usability and performance. Where possible, analytics data is processed at an aggregated level that does not identify individual Players.
• Preference Cookies: Used to remember your account preferences and settings, such as display preferences, to improve your experience on the platform.

ph859 does not use advertising or retargeting cookies. No personal data collected through cookies on ph859 is shared with advertising networks or social media platforms for the purpose of serving targeted advertisements.

Most web browsers allow you to manage cookie settings. Disabling strictly necessary cookies will impair your ability to use ph859's services. Disabling analytics or preference cookies may affect certain features but will not prevent basic platform access.

7Third-Party Data Sharing

ph859 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared with external parties only in the following circumstances:

• Payment Processors: Your financial transaction data is shared with GCash, PayMaya, BPI, BDO, Metrobank, and other payment providers strictly as necessary to process deposits and withdrawals. These providers are contractually required to use this data solely for payment processing purposes.
• Game Software Providers: Game session data (player identifier, wager amounts, game outcomes) is shared with game software providers to deliver game services and support audit trails. Providers receive only the minimum data required for game delivery and compliance purposes.
• Identity Verification Services: KYC document data and identity verification results may be processed by contracted third-party identity verification providers. All such providers operate under PAGCOR-compliant data processing agreements.
• PAGCOR and Regulatory Authorities: ph859 is legally required to share certain Player data and transaction records with PAGCOR as part of its regulatory reporting obligations. Data may also be disclosed to other competent Philippine government authorities (such as AMLC) where required by law.
• Law Enforcement: Where ph859 receives a valid legal request from a Philippine law enforcement authority, personal data may be disclosed in accordance with applicable law. ph859 will, where legally permitted, notify the affected Player of such a request.
• Professional Advisers: Legal counsel, auditors, and compliance advisers may have access to personal data on a strictly need-to-know basis where required to provide professional services to ph859, subject to professional confidentiality obligations.

8Data Security

ph859 implements technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your device and ph859's servers is protected by TLS/SSL encryption (256-bit). This applies to login sessions, form submissions, financial transactions, and all other data exchanges.
• Encryption at Rest: Sensitive personal data — including KYC documents, identity information, and financial records — is stored using encryption at rest on ph859's servers.
• Password Security: Account passwords are never stored in plaintext. They are processed using industry-standard one-way hashing algorithms. ph859 cannot retrieve or view your password.
• Access Controls: Access to personal data within ph859's systems is restricted to authorized personnel with a demonstrated operational need. Access permissions are reviewed regularly and revoked when no longer required.
• Intrusion Detection: ph859's systems are monitored for unauthorized access attempts and unusual activity patterns. Alerts are configured for anomalous login behavior, bulk data access, and other security indicators.
• Data Breach Response: In the event of a personal data breach that creates a real risk of serious harm to affected Players, ph859 is committed to notifying the National Privacy Commission (NPC) and affected Players within the timeframes prescribed by RA 10173 and its implementing rules.

While ph859 takes all reasonable precautions to protect your data, no digital system can guarantee absolute security against all possible threats. Players are also responsible for maintaining the security of their account credentials and devices used to access ph859.

9Data Retention

ph859 retains personal data for no longer than is necessary to fulfill the purposes for which it was collected, subject to applicable legal and regulatory retention requirements. The following general retention periods apply:

• Account and KYC data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, as required by PAGCOR regulatory standards and AMLA obligations.
• Financial transaction records: Retained for a minimum of five (5) years in compliance with AMLA and PAGCOR requirements.
• Gaming activity records: Retained for a minimum of three (3) years following the relevant game session, to support dispute resolution and regulatory audit requirements.
• Customer support records: Retained for three (3) years following the closure of the relevant support interaction.
• Marketing consent records: Retained for the duration of the marketing relationship and for one (1) year following opt-out, as evidence of consent.
• Technical logs and security data: Retained for twelve (12) months for security monitoring and fraud investigation purposes, after which they are deleted or anonymized.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with ph859's data disposal procedures, unless further retention is required by a specific legal obligation.

10Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by ph859. To exercise any of these rights, contact ph859's Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request".

11Children & Minors

ph859 does not knowingly collect personal data from any person under the age of 21. The minimum age for registration is 21 years, as mandated by PAGCOR and Philippine gaming law. ph859 enforces this requirement through government-issued ID verification during the KYC process.

12Cross-Border Data Transfers

ph859's primary data processing infrastructure is located in the Philippines. However, some contracted third-party service providers — including certain game software providers and payment processing networks — may process data in server facilities located outside the Philippines.

Where personal data is transferred outside the Philippines by ph859 or by a contracted processor, ph859 ensures that such transfers are conducted in accordance with the requirements of RA 10173, including verification that the recipient jurisdiction provides an adequate level of data protection or that appropriate safeguards (such as contractual data protection clauses) are in place.

13Marketing Communications

ph859 sends promotional and marketing communications — including bonus offers, game recommendations, and platform updates — only to Players who have expressly opted in to receive such communications during registration or through their account settings. Marketing communications are sent via SMS to your registered mobile number and/or via email to your registered email address.

You may opt out of marketing communications at any time by updating your notification preferences in your account settings, or by replying "STOP" to any SMS marketing message. ph859 will honor all opt-out requests within five (5) business days. Note that opting out of marketing communications does not affect the receipt of transactional communications relating to your account (such as deposit confirmations, withdrawal updates, and security alerts), which are sent as necessary components of the service.

14Policy Amendments

ph859 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, regulatory requirements, or platform features. Material changes — those that substantively affect how your personal data is processed or your rights under this policy — will be communicated to registered Players via email to their registered address and/or via a prominent notice on the ph859 platform, with a minimum of seven (7) days notice before the amended policy takes effect.

The current version of this Privacy Policy is always accessible at ph859.org/privacy-policy, together with its effective date and last-updated date. Your continued use of ph859's services after the effective date of any revision constitutes your acceptance of the updated policy.

15Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a privacy concern or complaint regarding ph859's data handling practices, please contact ph859 through the following channels:

• Email (Data Protection Inquiries): [email protected] — use subject line "Data Protection Inquiry" or "Data Subject Rights Request"
• Live Chat: Available 24/7 in your ph859 account dashboard for immediate assistance with privacy-related questions
• FAQ: Answers to common data privacy questions are available on our FAQ page

ph859 will acknowledge all privacy complaints within five (5) business days and endeavor to resolve them within twenty (20) business days. If you are not satisfied with ph859's response to your complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines.