phlao Privacy Policy

1. Introduction and Scope

phlao (referred to as "we," "us," "our," or "the Company") is committed to protecting the privacy and personal information of all users who access our online gaming platform, website, mobile applications, and related services (collectively, "the Platform"). This Privacy Policy constitutes a legally binding agreement between phlao and you ("User," "you," or "your") regarding the collection, use, storage, processing, and protection of your personal information.

This Privacy Policy is designed to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Republic of the Philippines, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC). We also align our practices with international privacy standards and best practices to ensure comprehensive protection of user data regardless of geographic location.

This Privacy Policy applies to:

• All personal information collected through phlao.cam, mobile applications, and related digital properties;
• Information obtained during account registration, identity verification, and Know Your Customer (KYC) procedures;
• Transaction data, gaming activity, and behavioral information gathered during platform use;
• Communications between users and phlao through customer support, email, live chat, or other channels;
• Marketing communications, promotional materials, and user preferences;
• Technical data collected through cookies, device identifiers, and tracking technologies.

This Privacy Policy should be read in conjunction with our Terms and Conditions, Responsible Gaming Policy, and Cookie Policy, which are incorporated by reference. In the event of any conflict between this Privacy Policy and other company policies, the provisions most protective of user privacy shall prevail to the extent permitted by law.

2. Information We Collect

To provide secure, compliant, and personalized gaming services, phlao collects various categories of personal information from users. The scope and nature of data collection depend on your interaction with our Platform, services used, and regulatory requirements applicable to online gaming operations.

2.1 Personal Identification Information

During account registration and identity verification processes, we collect the following personal identification information:

• Full Legal Name: Your complete name as it appears on government-issued identification documents;
• Date of Birth: To verify you meet the minimum age requirement of 21 years for online gambling in the Philippines;
• Gender: For account profiling and responsible gaming monitoring purposes;
• Nationality and Citizenship: To ensure compliance with jurisdiction-specific gaming regulations;
• Government-Issued ID Numbers: Passport numbers, driver's license numbers, Unified Multi-Purpose ID (UMID) numbers, or other official identification;
• Residential Address: Your complete physical address including street, barangay, city, province, and postal code;
• Photograph: Images from government ID documents and potentially selfie verification for enhanced security;
• Biometric Data: In limited circumstances, facial recognition data for identity verification and fraud prevention.

2.2 Contact Information

To maintain communication with you regarding account activities, promotions, and service updates, we collect:

• Email Address: Your primary and alternative email addresses for account communications, security alerts, and marketing (where consent is provided);
• Mobile Phone Number: For SMS notifications, two-factor authentication, withdrawal confirmations, and customer support;
• Preferred Communication Channels: Your preferences regarding communication methods and frequency;
• Language Preference: To provide customer service and content in your preferred language (English or Filipino).

2.3 Financial and Payment Information

To process deposits, withdrawals, and financial transactions, we collect and securely store:

• Payment Method Details: GCash account information, Maya (PayMaya) details, bank account numbers, cryptocurrency wallet addresses;
• Bank Information: Bank name, branch code, account holder name, and account number for wire transfers and bank deposits;
• Transaction History: Complete records of deposits, withdrawals, bonuses claimed, bets placed, and winnings received;
• Payment Card Information: For credit/debit card transactions, we collect card numbers (partially masked), expiration dates, and cardholder names. Note that full card details are processed by PCI-DSS compliant payment processors and not stored on our servers;
• Source of Funds Documentation: For large transactions or as required by Anti-Money Laundering (AML) regulations, we may collect bank statements, payslips, or other proof of income;
• Tax Information: For winnings reporting and tax compliance purposes as required by Philippine tax authorities.

2.4 Gaming Activity and Behavioral Data

To enhance user experience, ensure fair play, and comply with responsible gaming obligations, we collect:

• Betting History: All bets placed, including game type, stake amount, odds, outcomes, and timestamps;
• Game Sessions: Duration of gaming sessions, games played, win/loss records, and session frequency;
• Account Balance Changes: Real-time tracking of deposits, wagers, winnings, bonuses, and withdrawals;
• Bonus Utilization: Bonus claims, wagering progress, bonus forfeitures, and promotional engagement;
• Responsible Gaming Indicators: Playing patterns, session lengths, loss amounts, and self-exclusion requests;
• Risk Assessment Data: Behavioral patterns analyzed for fraud detection, problem gambling identification, and regulatory compliance.

2.5 Technical and Device Information

To ensure platform security, optimize performance, and prevent fraud, we automatically collect:

• IP Address: Your Internet Protocol address for geographic location verification and security monitoring;
• Device Information: Device type, operating system, browser type and version, screen resolution, and device identifiers;
• Mobile Device Data: For mobile app users, we collect device ID, mobile network information, and app version;
• Location Data: With your permission, GPS coordinates or location derived from IP address to ensure compliance with jurisdictional restrictions;
• Cookies and Tracking Technologies: Session cookies, persistent cookies, web beacons, and similar technologies (detailed in Section 9);
• Login and Access Logs: Timestamps of logins, logouts, failed login attempts, and IP addresses used to access your account;
• Technical Performance Data: Page load times, error messages, crash reports, and diagnostic information.

2.6 Communications and Customer Support Data

When you contact our customer support team or engage with phlao through various communication channels, we collect:

• Support Ticket Content: Questions, complaints, feedback, and all correspondence with our support staff;
• Live Chat Transcripts: Complete records of live chat conversations for quality assurance and dispute resolution;
• Email Correspondence: All emails sent to and received from phlao email addresses;
• Phone Call Recordings: When you contact us by phone, calls may be recorded for training, quality assurance, and regulatory compliance purposes. You will be notified before recording begins;
• Survey Responses: Feedback provided through customer satisfaction surveys, product feedback forms, or user research studies;
• Social Media Interactions: Public comments, messages, or interactions on phlao's official social media channels.

3. How We Collect Your Information

phlao employs multiple methods to collect personal information, each designed to balance user experience with security and compliance requirements:

3.1 Direct Collection from Users

The majority of personal information is provided directly by users through:

• Account Registration Forms: Information voluntarily submitted when creating a phlao account;
• Identity Verification Procedures: Documents uploaded during KYC verification, including ID scans, proof of address, and selfie verification;
• Payment Processing: Financial details provided when making deposits or requesting withdrawals;
• Profile Updates: Changes to account information, contact details, or preferences made through account settings;
• Voluntary Communications: Information shared when contacting customer support, participating in surveys, or providing feedback;
• Promotional Opt-Ins: Explicit consent provided for marketing communications, newsletters, and promotional offers.

3.2 Automatic Collection Through Technology

Certain information is collected automatically through technical means:

• Cookies and Similar Technologies: Browser cookies, flash cookies, web beacons, and pixel tags track user behavior and preferences;
• Server Logs: Web servers automatically record IP addresses, browser types, access times, and pages viewed;
• Mobile Application Analytics: Mobile SDKs collect device information, app usage patterns, and performance metrics;
• Gaming Platform Integration: Third-party game providers may share data about gameplay within their games hosted on our platform;
• Security Monitoring Systems: Fraud detection algorithms, anti-money laundering systems, and security software automatically analyze user behavior for suspicious activity.

3.3 Information from Third Parties

In limited circumstances, we receive information from external sources:

• Payment Processors: Financial institutions and payment service providers (GCash, Maya, banks) confirm transaction details and account verification;
• Identity Verification Services: Third-party KYC providers verify the authenticity of submitted identification documents;
• Credit Reference Agencies: For creditworthiness assessment in connection with certain payment methods;
• Affiliate Partners: If you arrive at phlao through an affiliate link, we may receive referral information;
• Social Media Platforms: If you choose to register using social media credentials, we receive basic profile information from the social network;
• Regulatory Authorities: Information from PAGCOR, National Privacy Commission, or other regulatory bodies in connection with compliance monitoring or investigations.

4. How We Use Your Personal Information

phlao processes personal information for legitimate business purposes related to providing secure, compliant, and high-quality online gaming services. Specific purposes include:

4.1 Account Management and Service Provision

• Creating, maintaining, and authenticating user accounts;
• Verifying user identity and eligibility to participate in online gambling;
• Processing deposits, withdrawals, and financial transactions;
• Managing bonus eligibility, wagering requirements, and promotional participation;
• Providing access to gaming products including slots, table games, live dealer games, and sports betting;
• Maintaining accurate account balances and transaction histories;
• Enabling customer support services and resolving user inquiries;
• Administering VIP programs, loyalty rewards, and player tier benefits.

4.2 Regulatory Compliance and Legal Obligations

• Complying with Philippine Anti-Money Laundering Act (AMLA) requirements including transaction monitoring and suspicious activity reporting;
• Meeting Know Your Customer (KYC) and Customer Due Diligence (CDD) obligations;
• Fulfilling PAGCOR licensing conditions and regulatory reporting requirements;
• Responding to lawful requests from government authorities, law enforcement, or courts;
• Preventing money laundering, terrorist financing, and financial crimes;
• Maintaining records as required by gaming regulations and tax laws;
• Cooperating with investigations of suspected illegal activity or terms violations;
• Reporting taxable winnings to the Bureau of Internal Revenue as required by Philippine tax law.

4.3 Security, Fraud Prevention, and Risk Management

• Detecting and preventing fraudulent transactions, account takeovers, and identity theft;
• Identifying multiple accounts, bonus abuse, and terms violations;
• Monitoring betting patterns for match-fixing, collusion, or other forms of cheating;
• Protecting platform integrity through technical security measures and threat detection;
• Investigating disputes, chargebacks, and payment irregularities;
• Enforcing Terms and Conditions, Community Guidelines, and user agreements;
• Protecting phlao, its users, and third parties from harm, fraud, or illegal activity.

4.4 Responsible Gaming and Player Protection

• Implementing age verification to prevent underage gambling;
• Monitoring gaming behavior for signs of problem gambling or gambling addiction;
• Administering deposit limits, loss limits, session time limits, and cooling-off periods;
• Processing self-exclusion requests and maintaining exclusion databases;
• Providing access to responsible gaming tools and resources;
• Identifying at-risk players and offering proactive intervention when appropriate;
• Complying with social responsibility obligations under PAGCOR regulations.

4.5 Service Improvement and Personalization

• Analyzing user preferences, gaming patterns, and platform usage to improve services;
• Personalizing game recommendations, content, and user interface based on interests;
• Conducting market research, user surveys, and product development initiatives;
• Optimizing website and mobile app performance, load times, and user experience;
• Testing new features, games, and functionalities with user segments;
• Developing and training machine learning models for fraud detection and personalization;
• Generating aggregated, anonymized statistics and insights for business intelligence.

4.6 Marketing and Communications (With Consent)

• Sending promotional emails, SMS messages, and push notifications about bonuses, tournaments, and new games (only to users who have opted in);
• Displaying personalized advertisements based on gaming preferences and behavior;
• Communicating special VIP offers, exclusive promotions, and loyalty rewards;
• Sharing news, updates, and important platform announcements;
• Conducting promotional campaigns, contests, and prize draws;
• Segmenting users for targeted marketing based on activity levels and preferences;
• Measuring marketing campaign effectiveness and return on investment.

5. Data Sharing and Disclosure to Third Parties

phlao does not sell, rent, or trade user personal information to third parties for their marketing purposes. However, we share personal information with select third parties in the following circumstances:

5.1 Service Providers and Business Partners

We engage trusted third-party service providers to perform functions on our behalf:

• Payment Processors: GCash, Maya, bank partners, cryptocurrency exchanges, and payment gateways process financial transactions;
• Identity Verification Services: KYC vendors verify identity documents and perform fraud checks;
• Game Content Providers: Third-party game developers and providers whose games are hosted on our platform receive limited gameplay data;
• Cloud Hosting Providers: Infrastructure providers that host our servers, databases, and applications;
• Customer Support Platforms: Live chat software, ticketing systems, and CRM platforms;
• Email Service Providers: Marketing automation and transactional email platforms;
• Analytics and Monitoring Tools: Website analytics, mobile app analytics, and performance monitoring services;
• Security and Fraud Prevention Vendors: Specialized security tools, fraud detection systems, and threat intelligence platforms.

All service providers are contractually obligated to protect user data, use information only for specified purposes, and comply with applicable data protection laws.

5.2 Regulatory Authorities and Legal Requirements

We disclose personal information to government authorities and regulatory bodies when required by law:

• Philippine Amusement and Gaming Corporation (PAGCOR): For licensing compliance, audit purposes, and regulatory reporting;
• Anti-Money Laundering Council (AMLC): For suspicious transaction reports and compliance with AMLA;
• Bureau of Internal Revenue (BIR): For tax reporting and withholding tax on winnings;
• National Privacy Commission (NPC): In response to privacy complaints or data breach investigations;
• Law Enforcement Agencies: Pursuant to valid court orders, subpoenas, or lawful government requests;
• Courts and Legal Counsel: In connection with legal proceedings, disputes, or investigations.

5.3 Corporate Transactions

If phlao is involved in a merger, acquisition, sale of assets, bankruptcy, or corporate restructuring, personal information may be transferred to successor entities or purchasers as part of the business transaction. Users will be notified of such changes through prominent notice on our website.

5.4 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify individual users with:

• Business partners for market analysis and trend identification;
• Research organizations for studies on gaming behavior and responsible gambling;
• Industry associations for benchmarking and best practice development;
• Advertising networks for campaign optimization (without personal identifiers).

6. Data Security Measures and Protection

phlao implements comprehensive technical, organizational, and physical security measures to protect personal information from unauthorized access, disclosure, alteration, or destruction:

6.1 Technical Security Controls

• Encryption: All data transmissions are protected using industry-standard TLS/SSL encryption (minimum TLS 1.2). Sensitive data stored in databases is encrypted at rest using AES-256 encryption;
• Access Controls: Role-based access control (RBAC) systems ensure employees can only access information necessary for their job functions;
• Authentication: Multi-factor authentication (MFA) is required for all employee access to systems containing personal information;
• Network Security: Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) protect network infrastructure;
• Vulnerability Management: Regular security assessments, penetration testing, and vulnerability scanning identify and remediate security weaknesses;
• Data Loss Prevention: DLP tools monitor and prevent unauthorized transfer of sensitive information;
• Secure Development: Security-by-design principles and secure coding practices minimize application vulnerabilities.

6.2 Organizational Security Measures

• Employee Training: Regular data protection and security awareness training for all staff handling personal information;
• Confidentiality Agreements: All employees, contractors, and service providers sign confidentiality agreements;
• Incident Response: Comprehensive incident response plan for detecting, containing, and responding to security breaches;
• Third-Party Management: Due diligence and ongoing monitoring of service providers' security practices;
• Data Minimization: Collection and retention only of information necessary for specified purposes;
• Privacy Impact Assessments: Regular assessments of privacy risks associated with data processing activities.

6.3 Physical Security

• Restricted access to data centers and server rooms;
• Video surveillance and security personnel at facilities housing servers;
• Secure disposal procedures for hardware containing personal information;
• Environmental controls to protect against physical damage to data infrastructure.

6.4 User Security Responsibilities

While phlao implements robust security measures, users also bear responsibility for account security:

• Choose strong, unique passwords and change them regularly;
• Enable two-factor authentication on your account;
• Never share account credentials with third parties;
• Log out after each session, especially on shared or public devices;
• Keep contact information current to receive security alerts;
• Immediately report suspected unauthorized account access.

7. Data Retention Periods

phlao retains personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

7.1 Active Account Data

• Account Information: Retained for the duration of account activity plus regulatory retention requirements;
• Transaction Records: Maintained for 5 years after transaction date as required by AMLA and PAGCOR regulations;
• Gaming Activity: Retained for 5 years to support audits, dispute resolution, and responsible gaming monitoring;
• KYC Documentation: Maintained for 5 years after account closure per regulatory requirements;
• Communication Records: Customer support transcripts retained for 3 years for quality assurance and dispute resolution.

7.2 Closed Account Data

When you close your account, we retain certain information to:

• Comply with legal, tax, audit, and regulatory obligations;
• Prevent fraud and enforce terms violations;
• Resolve any pending disputes or claims;
• Maintain self-exclusion databases to prevent account reopening.

After mandatory retention periods expire, personal information is securely deleted or anonymized.

7.3 Marketing Data

If you unsubscribe from marketing communications, we will cease promotional mailings but retain the minimum information necessary to honor your opt-out preference and prevent future marketing contact.

8. Your Privacy Rights Under Philippine Law

Under the Data Privacy Act of 2012, Filipino data subjects have the following rights regarding their personal information:

8.1 Right to Be Informed

You have the right to be informed about the collection, use, and processing of your personal information. This Privacy Policy serves as notice of our data practices.

8.2 Right to Access

You may request access to your personal information held by phlao, including:

• Contents of your personal data being processed;
• Sources from which data was obtained;
• Names and addresses of recipients of your data;
• Manner of data processing;
• Reasons for disclosure to third parties;
• Information about automated decision-making processes.

To exercise this right, contact our Data Protection Officer using the details in Section 13. We will respond within fifteen (15) calendar days.

8.3 Right to Rectification

You may request correction of inaccurate, incomplete, or outdated personal information. Most account details can be updated directly through your account settings. For other corrections, contact customer support.

8.4 Right to Erasure or Blocking

You may request deletion or blocking of your personal information in the following circumstances:

• Data is no longer necessary for the purposes for which it was collected;
• You withdraw consent and no other legal ground for processing exists;
• Data was unlawfully processed;
• Erasure is required to comply with a legal obligation.

This right is subject to legal exceptions where we must retain data for regulatory compliance, legal proceedings, or fraud prevention.

8.5 Right to Object

You may object to processing of your personal information for:

• Direct marketing purposes (you can opt out at any time);
• Processing based on legitimate interests where your fundamental rights override our interests;
• Automated decision-making or profiling that produces legal effects.

8.6 Right to Data Portability

You have the right to obtain a copy of your personal information in a commonly used, machine-readable format and transmit it to another service provider. This applies to data you provided based on consent or contract performance.

8.7 Right to File a Complaint

If you believe phlao has violated your privacy rights, you may file a complaint with the National Privacy Commission:

• National Privacy Commission
• 5th Floor, Philippine International Convention Center (PICC)
• Vicente Sotto Street, Pasay City 1308, Metro Manila
• Email: [email protected]
• Hotline: (02) 8234-2228

9. Cookies and Tracking Technologies

phlao uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyze platform usage, and deliver personalized content and advertising.

9.1 Types of Cookies Used

• Essential Cookies: Required for basic platform functionality including authentication, security, and session management. These cannot be disabled without impairing platform functionality;
• Performance Cookies: Collect anonymous information about platform usage, page views, load times, and errors to optimize performance;
• Functionality Cookies: Remember user preferences such as language, currency, and display settings;
• Targeting/Advertising Cookies: Track browsing behavior across websites to deliver relevant advertisements and measure campaign effectiveness;
• Analytics Cookies: Gather data about user behavior, demographics, and interaction patterns for business intelligence.

9.2 Managing Cookie Preferences

Most web browsers automatically accept cookies, but you can modify browser settings to:

• Block all cookies;
• Accept only first-party cookies;
• Delete cookies after each browsing session;
• Receive notification before cookies are set.

Note that disabling cookies may impair platform functionality and limit your ability to use certain features.

9.3 Third-Party Tracking

Our platform may include content and services from third parties (game providers, payment processors, analytics services) that use their own cookies and tracking technologies. We do not control these third-party technologies and encourage you to review their privacy policies.

10. International Data Transfers

While phlao primarily operates within the Philippines, some personal information may be transferred to, stored in, or processed by service providers located outside the Philippines in jurisdictions that may have different data protection laws.

When transferring personal information internationally, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by the National Privacy Commission;
• Service providers in countries recognized by the NPC as having adequate data protection;
• Binding corporate rules for transfers within corporate groups;
• Your explicit consent for specific transfers;
• Necessity for contract performance or legal obligations.

Users can obtain more information about international transfers and copies of safeguards by contacting our Data Protection Officer.

11. Children's Privacy and Age Restrictions

Online gambling is strictly prohibited for persons under 21 years of age. phlao does not knowingly collect personal information from individuals under 21 and does not target services or marketing to minors.

Our age verification procedures include:

• Mandatory date of birth collection during registration;
• Government-issued ID verification requiring proof of age;
• Automated systems to block account creation by underage users;
• Ongoing monitoring to detect potential underage access;
• Immediate account closure if underage use is discovered.

If we become aware that we have inadvertently collected personal information from a person under 21, we will delete the information immediately, close the account, and refund any deposited funds to the source account.

Parents or guardians who believe a minor has accessed our services should contact us immediately at [email protected].

12. Changes to This Privacy Policy

phlao reserves the right to update this Privacy Policy to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document;
• Notify registered users via email to their registered email address;
• Display prominent notice on our website and mobile applications;
• In cases involving significant changes to data processing practices, seek renewed consent where required by law.

Your continued use of phlao services following notice of Privacy Policy changes constitutes acceptance of the updated practices. If you disagree with modifications, your remedy is to discontinue use and close your account. We recommend periodically reviewing this Privacy Policy to stay informed about how we protect your information.

13. Contact Information and Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

When contacting us about privacy matters, please include:

• Your full name and registered email address;
• Clear description of your inquiry or request;
• Specific information or documents you wish to access, correct, or delete;
• Preferred method and language for receiving our response.

For urgent security matters or suspected data breaches, please use our priority security email: [email protected] or contact customer support via 24/7 live chat for immediate assistance.