phtay Privacy Policy
— How We Handle Your
Personal Information

1 About This Privacy Policy

phtay is committed to protecting the privacy and security of every player who uses our platform. This Privacy Policy has been prepared in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations, as enforced by the National Privacy Commission of the Philippines.

This Policy applies to all personal data collected through the phtay website at phtay.cam, our mobile-optimised platform, customer support channels, and any other services offered by phtay. It should be read alongside phtay's Terms & Conditions, which govern your use of the Platform generally.

phtay reviews and updates this Privacy Policy periodically to reflect changes in our data practices, regulatory requirements, or business operations. The date of the most recent update is always displayed at the top of this page.

2 Data Controller

For the purposes of the Philippine Data Privacy Act and applicable data protection legislation, phtay acts as the personal information controller ("PIC") in respect of personal data collected through the Platform. As PIC, phtay determines the purposes and means of processing personal data and is responsible for ensuring that processing is carried out in compliance with applicable law.

Where phtay engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification providers, and analytics services — those parties act as personal information processors ("PIP") and are bound by data processing agreements that impose obligations equivalent to those required under Philippine law.

3 Personal Data We Collect

phtay collects the following categories of personal data in connection with your use of the Platform:

phtay does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data unless specifically required by law and disclosed at the point of collection.

4 How We Collect Your Data

phtay collects personal data through the following means:

• Direct collection — data you provide when registering your phtay Account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or participating in promotions;
• Automated collection — technical data collected automatically when you access and use the Platform, including through cookies, log files, and session tracking technologies;
• Third-party sources — identity and fraud-screening data received from KYC verification providers, payment processors such as GCash and PayMaya, and fraud-prevention databases, where permitted by applicable law;
• Publicly available sources — information from publicly accessible databases where relevant to regulatory compliance or fraud investigation purposes.

5 Legal Basis for Processing

phtay processes personal data on the following legal grounds as recognised under the Philippine Data Privacy Act of 2012:

• Contractual necessity — processing required to perform our obligations under the Terms & Conditions, including Account management, payment processing, and game delivery;
• Legal obligation — processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and other applicable Philippine laws and regulations;
• Legitimate interests — processing necessary for fraud prevention, platform security, responsible gaming monitoring, and analytics — where these interests are not overridden by your rights;
• Consent — for optional data processing activities such as marketing communications, where you have provided clear, affirmative consent that can be withdrawn at any time.

6 How We Use Your Personal Data

phtay uses the personal data we collect for the following purposes:

• To create, manage, and maintain your phtay Account;
• To verify your identity and age in compliance with PAGCOR requirements and Philippine law;
• To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank;
• To detect, investigate, and prevent fraud, money laundering, and other illegal activities;
• To monitor gaming activity for responsible gaming compliance and to administer self-imposed limits and exclusions;
• To provide personalised game recommendations, tailored promotions, and a customised platform experience;
• To respond to support inquiries, resolve disputes, and maintain correspondence records;
• To comply with regulatory reporting obligations and respond to lawful requests from authorities;
• To send service-related communications such as transaction confirmations, security alerts, and account notifications;
• To send marketing communications where you have consented to receive them.

phtay will not use your personal data for any purpose that is materially different from those described in this Policy without first obtaining your consent or establishing a new legal basis for processing.

7 Sharing Your Personal Data

phtay does not sell your personal data. We share personal data only in the following circumstances, and only to the extent necessary for the stated purpose:

• Payment processors — GCash, PayMaya, BPI, BDO, and Metrobank receive transaction data necessary to process deposits and withdrawals;
• KYC and identity verification providers — receive identity and document data to perform age and identity checks required by regulation;
• Game providers — receive a pseudonymous player identifier to deliver game services; they do not receive your full personal details;
• Fraud prevention and security services — receive technical and behavioural data to identify and prevent fraudulent activity;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities may receive data where required by law or regulatory order;
• Professional advisers — lawyers, auditors, and accountants where necessary for legal compliance, audit, and regulatory purposes, under strict confidentiality obligations.

All third parties with whom phtay shares personal data are required to implement appropriate technical and organisational security measures and are prohibited from using your data for their own marketing purposes.

8 International Data Transfers

Some of phtay's service providers — including game developers, cloud infrastructure providers, and analytics platforms — are based outside the Philippines. Where personal data is transferred to recipients in other countries, phtay ensures that appropriate safeguards are in place as required under Section 21 of the Philippine Data Privacy Act, including:

• Standard contractual clauses approved by the National Privacy Commission;
• Binding corporate rules where the recipient is part of a group with approved data protection policies;
• Transfers to countries recognised by the NPC as providing an adequate level of data protection.

You may request details of the safeguards applicable to any specific international transfer by contacting phtay's Data Protection Officer using the contact details in Section 17.

9 Data Retention

phtay retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law and regulatory obligations:

• Account and KYC records — retained for a minimum of five (5) years from Account closure, as required by PAGCOR and AMLA regulations;
• Financial transaction records — retained for a minimum of five (5) years from the date of each transaction;
• Communications records — retained for three (3) years from the date of the last communication, or longer where relevant to a dispute or regulatory matter;
• Technical and log data — retained for up to twelve (12) months from collection, unless required for active fraud or security investigations.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with phtay's data disposal procedures.

10 Cookies & Tracking Technologies

phtay uses the following types of cookies and similar technologies when you access the Platform:

• Strictly necessary cookies — required for core platform functionality including session management, login authentication, and security features. These cannot be disabled without impairing your ability to use the Platform;
• Analytics cookies — used to collect anonymised data about how players navigate and interact with the Platform, enabling phtay to identify and resolve technical issues and improve the user experience;
• Preference cookies — used to remember your language, display, and game preferences to personalise your experience on return visits.

phtay does not use third-party advertising or cross-site tracking cookies. You may manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of some features on the Platform.

11 Data Security

phtay implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• AES-256 encryption for personal and financial data stored at rest;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Comprehensive access logging and anomaly detection systems;
• Regular penetration testing and third-party security audits;
• Two-factor authentication options for player Accounts;
• Automated alerts for unusual login or transaction activity.

In the event of a personal data breach that poses a risk to your rights and freedoms, phtay will notify you and the National Privacy Commission within the timeframes required under Philippine law, and will take all reasonable steps to mitigate the impact of the breach.

12 Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by phtay:

• Right to be informed — to be told how your data is being collected, processed, and used (fulfilled by this Policy);
• Right of access — to request a copy of the personal data phtay holds about you;
• Right to correction — to request correction of inaccurate, incomplete, or outdated personal data;
• Right to erasure or blocking — to request deletion or restriction of processing of your personal data where the data is unlawfully processed or the purpose of processing has ceased;
• Right to object — to object to processing based on legitimate interests, including the use of your data for direct marketing;
• Right to data portability — to request a copy of your personal data in a structured, commonly used, and machine-readable format;
• Right to damages — to seek compensation for any damages suffered as a result of inaccurate, incomplete, outdated, or unlawfully obtained personal data.

To exercise any of these rights, please contact phtay's Data Protection Officer using the contact details provided in Section 17. phtay will respond to all verified requests within 15 business days, or within any shorter period required by applicable law.

13 Children's Privacy

phtay is an online gaming platform intended exclusively for adults aged 21 years and above, in accordance with PAGCOR's minimum age requirements. phtay does not knowingly collect personal data from individuals under the age of 21.

If phtay becomes aware that personal data has been collected from a person under 21 years of age, that Account will be immediately suspended, all associated data will be deleted in accordance with applicable law, and any deposits will be returned to the original payment source following identity confirmation.

If you believe that a person under 21 in your household has accessed or registered on phtay, please contact our support team immediately so we can take appropriate action.

14 Third-Party Links

The phtay Platform may contain links to third-party websites, including payment provider portals and game provider information pages. phtay is not responsible for the privacy practices of any third-party websites and this Privacy Policy does not apply to those sites.

We encourage you to review the privacy policy of any third-party website you visit. The inclusion of a link to a third-party website does not constitute an endorsement of that website or its privacy practices by phtay.

15 Marketing Communications

Where you have provided consent during Account registration or at a later point, phtay may contact you with information about promotions, new games, platform updates, and events relevant to your interests as a phtay player. Marketing communications may be delivered via SMS to your registered Philippine mobile number or via in-platform notifications.

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your Account settings or by contacting our support team. Withdrawal of marketing consent does not affect service communications that are necessary for the operation of your Account (such as security alerts and transaction confirmations).

16 Amendments to This Policy

phtay reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Where changes are material, phtay will provide advance notice by posting the updated Policy on this page with a revised effective date and, where practicable, by notifying registered Players via their registered mobile number or through an in-platform notification.

We encourage you to review this Policy periodically. Your continued use of the Platform following the posting of any amended Privacy Policy constitutes your acceptance of the revised terms, to the extent permitted by applicable law. Where changes require fresh consent under the Data Privacy Act, phtay will obtain that consent before processing continues under the new basis.

17 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or want to raise a concern about how phtay handles your personal data, please contact our Data Protection Officer through phtay's 24/7 live chat support available from within your Account dashboard, or via the support email address displayed in the website footer. Please mark your message as a Data Privacy Inquiry for prioritised routing.

If you believe phtay has not adequately addressed your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC is the competent supervisory authority for data protection matters under the Philippine Data Privacy Act of 2012.