phhalik Privacy Policy

1 About This Policy

phhalik is committed to protecting the privacy of all its users. This Policy describes the types of personal data phhalik holds about you, the lawful bases on which we process that data, the purposes for which it is used, the circumstances in which it may be shared, your rights as a data subject under Philippine law, and how to contact us regarding data privacy matters.

phhalik processes personal data in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). Where phhalik is subject to PAGCOR reporting obligations, data disclosures are made as required by applicable regulatory frameworks.

2 Data Controller

phhalik, the operator of phhalik.club, acts as the personal information controller ("PIC") in respect of personal data collected from Platform users. As a PIC, phhalik determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with the DPA.

For all data privacy enquiries, requests to exercise data subject rights, or to contact phhalik's designated Data Protection Officer ("DPO"), please use the contact details provided in Section 15 of this Policy.

3 Personal Data We Collect

phhalik collects the following categories of personal data from Platform users, depending on the nature of your interaction with the Platform:

phhalik does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as racial or ethnic origin, political affiliations, religious beliefs, health data, or biometric data) unless specifically required for identity verification and lawfully permitted.

4 How We Collect Personal Data

phhalik collects personal data through the following channels:

4.1 Direct Collection

Data you provide directly when you register a phhalik account, complete KYC verification, make deposits or withdrawals, contact phhalik support, participate in promotions, or respond to surveys and communications from phhalik.

4.2 Automated Collection

Technical and usage data collected automatically when you access and use the phhalik Platform, including through cookies, web beacons, session logs, and similar tracking technologies as described in Section 6 of this Policy.

4.3 Third-Party Sources

Identity and fraud-screening data received from KYC verification service providers and payment processors (including GCash, PayMaya, and partner banks) in connection with account verification and payment processing. phhalik may also receive data from PAGCOR or other regulatory authorities in connection with its licensing and compliance obligations.

5 Purposes & Legal Bases for Processing

phhalik processes your personal data for the following purposes and on the following lawful bases under the DPA:

6 Cookies & Tracking Technologies

6.1 What We Use

The phhalik Platform uses cookies, web beacons, and similar session tracking technologies to operate core Platform functions, maintain your login session, prevent fraud, and analyse usage patterns. Cookies are small text files stored on your device by your browser.

6.2 Types of Cookies

• Strictly Necessary Cookies: Required for basic Platform functionality, including session management, authentication, and security. These cannot be disabled without breaking the Platform.
• Functional Cookies: Store your language and display preferences to improve your experience across sessions.
• Analytics Cookies: Allow phhalik to understand how players interact with the Platform in aggregate, used to improve game lobby layout, navigation, and promotional displays.
• Marketing Cookies: Used to tailor promotional offers and bonus messaging displayed within your phhalik account. These are only set with your consent.

6.3 Managing Cookies

You may adjust cookie preferences through the phhalik cookie settings panel accessible from the Platform footer, or through your browser's privacy settings. Disabling non-essential cookies will not prevent you from using core phhalik features but may affect the personalisation of your experience.

7 Sharing Your Personal Data

phhalik does not sell or rent your personal data to third parties. We may disclose your data to the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• KYC and Identity Verification Providers: Third-party service providers engaged to verify government-issued IDs and confirm age eligibility in compliance with PAGCOR requirements.
• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and their respective payment networks, to facilitate the processing of deposits and withdrawals.
• Game Software Providers: Licensed game studios whose software operates on the phhalik Platform may receive the minimum data necessary to operate their games and detect technical abuse (e.g., session tokens, anonymised bet data).
• IT and Hosting Providers: Cloud and data centre providers that host the phhalik Platform infrastructure, subject to contractual data processing agreements.
• Regulatory and Government Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement, and courts of the Philippines, where disclosure is required by law or a valid legal order.
• Professional Advisers: Lawyers, accountants, and auditors engaged by phhalik under confidentiality obligations, to the extent required for legitimate business purposes.

All third-party service providers who process personal data on behalf of phhalik are contractually required to process that data only on phhalik's instructions, maintain appropriate security measures, and comply with applicable Philippine data privacy law.

8 International Data Transfers

phhalik is a Philippines-based platform and primarily processes data within the Republic of the Philippines. Where data is processed by service providers outside the Philippines — such as international cloud hosting providers or game software studios — phhalik ensures that appropriate safeguards are in place consistent with the DPA and NPC guidelines on cross-border data transfers, including data processing agreements that impose equivalent data protection obligations on the recipient.

9 Data Retention

phhalik retains personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law. The following general retention guidelines apply:

• KYC and identity verification records: Retained for a minimum of five (5) years following account closure, as required under PAGCOR regulations and Philippine anti-money laundering law.
• Transaction and bet records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC requirements.
• Account data: Retained for the duration of the account and for up to three (3) years following permanent account closure, unless a longer period is required by law.
• Support communications: Retained for up to three (3) years from the date of the last communication, for dispute resolution purposes.
• Marketing consent records: Retained for as long as the consent remains active, plus three (3) years from withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

10 Data Security

phhalik implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data in transit between your device and phhalik servers.
• Encryption of sensitive data at rest, including government ID data and financial account references.
• Role-based access controls limiting internal access to personal data to authorised personnel on a need-to-know basis.
• Regular penetration testing, vulnerability scanning, and security audits of Platform infrastructure.
• Two-factor authentication available to players for account login security, and mandatory for internal admin access.
• Comprehensive incident response procedures for identification, containment, and notification of data security incidents.

While phhalik employs industry-standard security practices, no digital platform can guarantee absolute security. Players are responsible for maintaining the confidentiality of their own login credentials and should contact phhalik support immediately upon suspecting unauthorised account access.

11 Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of personal data phhalik holds about you. To exercise any of these rights, please contact phhalik's Data Protection Officer using the details in Section 15.

12 Children's Privacy

The phhalik Platform is strictly intended for individuals who are 21 years of age or older in accordance with PAGCOR's age eligibility requirements. phhalik does not knowingly collect personal data from individuals under the age of 21. Account registration requires KYC age verification using a government-issued Philippine ID.

If phhalik becomes aware that personal data has been collected from an individual who does not meet the minimum age requirement, the account will be closed, the data will be deleted in accordance with applicable law, and any balance will be returned to the funding source used for deposits, net of any bonus funds.

Parents or guardians who believe a minor may have accessed the phhalik Platform should contact phhalik support immediately using the details in Section 15.

13 Responsible Gaming Data

Personal data related to your use of phhalik's responsible gaming tools — including deposit limits, loss limits, session time limits, and self-exclusion records — is treated with heightened confidentiality. This data is:

• Processed exclusively for the purpose of applying the tools you have activated and monitoring compliance with them.
• Retained for the duration of your account and for a period of five (5) years following permanent account closure, to assist in honouring any self-exclusion periods that may still apply.
• Not used for marketing or promotional purposes.
• Shared with PAGCOR only to the extent required by applicable PAGCOR responsible gaming regulatory obligations.

For more information on phhalik's responsible gaming tools, please visit the Responsible Gaming page.

14 Amendments to This Policy

phhalik may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features. The date of the most recent revision is displayed at the top of this page. Where changes are material, phhalik will notify registered players via email or in-platform notification prior to the changes taking effect. Continued use of the phhalik Platform following notification of amendments constitutes acknowledgement of the updated Policy.

15 Contact & Complaints

For all data privacy enquiries, requests to exercise your data subject rights, or to contact phhalik's Data Protection Officer, please use the following contact details:

• Data Protection Officer, phhalik
• Email: [email protected]
• Platform: Via the Support or Help section accessible after login at phhalik.club

If you are not satisfied with phhalik's handling of your personal data or our response to a data subject rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on the NPC's official website.