phcsh Privacy Policy

phcsh ("we," "us," "our," or "the Company") is the operator of the online gaming platform available at phcsh.app, licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR). As a licensed Philippine gaming operator, phcsh is required to comply with the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and the circulars and advisories issued by the National Privacy Commission ("NPC").

This Privacy Policy ("Policy") describes how phcsh collects, uses, processes, stores, discloses, and otherwise handles the personal data of individuals who interact with the phcsh platform — including registered account holders, visitors to our website, and individuals who contact our support team. It also describes the rights you hold as a data subject under Philippine law and how you may exercise those rights.

This Policy should be read in conjunction with the phcsh Terms and Conditions, which govern your contractual relationship with phcsh as a player.

2.1 phcsh acts as the Personal Information Controller ("PIC") in respect of the personal data of its players and website visitors, as that term is defined under Section 3(h) of the Data Privacy Act of 2012.

2.2 As Personal Information Controller, phcsh determines the purposes and means of processing your personal data and bears the corresponding obligations and liabilities under the DPA and its IRR.

2.3 phcsh has appointed a Data Protection Officer ("DPO") as required under NPC Circular 17-01. The DPO may be contacted for all privacy-related inquiries, data subject requests, and concerns as detailed in Section 15 of this Policy.

phcsh collects the following categories of personal data in the course of providing its platform and services:

3.1 Sensitive Personal Information. Certain data phcsh collects — particularly government-issued ID information and financial account data — qualifies as sensitive personal information under Section 3(l) of the DPA. phcsh applies heightened protection standards to all sensitive personal information in its possession, including stricter access controls, enhanced encryption, and more limited internal disclosure.

3.2 Data from Third Parties. phcsh may receive personal data about you from third-party sources, including payment processors (for transaction verification), PAGCOR and other regulatory bodies (for compliance purposes), and identity verification service providers engaged to assist with KYC obligations.

phcsh uses the personal data it collects for the following purposes:

• Account Creation and Management: To create and maintain your phcsh player account, verify your identity and age (KYC), and manage your account preferences and settings.
• Platform Services: To provide access to phcsh games, process wagers, calculate and credit winnings, and operate all platform features accessible after phcsh login.
• Payment Processing: To process deposits (via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and 7-Eleven) and withdrawals to your registered payment methods, and to verify the legitimacy of financial transactions.
• Regulatory Compliance: To comply with phcsh's obligations under PAGCOR's licensing requirements, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act (RA 10173), and other applicable Philippine laws and regulations.
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling, to enforce responsible gaming tools (deposit limits, self-exclusion) applied by you or by phcsh, and to communicate responsible gaming resources where appropriate.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, money laundering, identity theft, and unauthorised account access; to maintain the integrity and security of the phcsh platform.
• Customer Support: To respond to your inquiries, resolve disputes, and provide assistance through phcsh's 24/7 Filipino support team.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — subject to your communication preferences. You may opt out of marketing communications at any time through your account settings.
• Platform Improvement: To analyse usage patterns, improve game offerings, optimise the phcsh user interface, and develop new features based on aggregated and anonymised player data.

phcsh processes your personal data on the following legal bases as recognised under Section 12 and Section 13 of the Data Privacy Act of 2012:

• Contract Performance (Section 12(b)): Processing necessary for the performance of the contract between you and phcsh — including account management, gameplay facilitation, payment processing, and the provision of all platform services.
• Legal Obligation (Section 12(c)): Processing required by applicable Philippine law, including PAGCOR licensing obligations, Anti-Money Laundering Act compliance, KYC verification requirements, and NPC registration.
• Legitimate Interests (Section 12(f)): Processing for phcsh's legitimate interests in platform security, fraud prevention, and service improvement — where such interests do not override your fundamental rights and freedoms as a data subject.
• Consent (Section 12(a) / Section 13(b)): Processing of sensitive personal information (including government ID data) and processing for direct marketing communications, where phcsh has obtained your prior, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6.1 phcsh does not sell, rent, or trade your personal data to any third party for commercial purposes. phcsh shares personal data only in the following circumstances:

• Service Providers (Personal Information Processors): phcsh engages third-party service providers — including cloud hosting providers, payment processors (GCash, PayMaya, BancNet), identity verification services, live game software providers, and customer support technology providers — who process personal data on phcsh's behalf under written data processing agreements that impose equivalent data protection standards.
• Regulatory Authorities: phcsh discloses personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government agencies where required by applicable law or regulatory directive.
• Law Enforcement: Where required by a valid court order, subpoena, or lawful direction from Philippine law enforcement authorities, phcsh will disclose personal data to the extent legally required.
• Business Transfers: In the event of a merger, acquisition, or sale of the phcsh business or its assets, personal data held by phcsh may be transferred to the successor entity, subject to the same protections applied under this Policy and applicable law.

6.2 All third-party service providers who handle phcsh player data are contractually required to process such data only for the specific purposes for which it was shared, to maintain appropriate technical and organisational security measures, and to comply with applicable Philippine data protection law.

7.1 The phcsh platform uses cookies and similar tracking technologies to ensure proper platform functionality, maintain your authenticated session after phcsh login, and collect analytical data about platform usage. The following types of cookies are used:

• Essential Cookies: Required for core platform functions, including maintaining your login session, remembering your preferences, and ensuring the security of your account. These cookies cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players use the phcsh platform — such as which games are most popular and how long sessions last — to help phcsh improve the platform experience.
• Security Cookies: Used for device fingerprinting, fraud detection, and identifying unusual login behaviour to protect your phcsh account from unauthorised access.

7.2 You may manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the phcsh platform, including your ability to remain logged in during a gaming session.

7.3 phcsh does not use cookies or tracking technologies to serve advertising on third-party websites, and does not share tracking data with advertising networks.

8.1 phcsh implements the following technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Transport Encryption: All data transmitted between your device and the phcsh platform is encrypted using TLS 1.2 or higher (256-bit SSL), the same standard applied by Philippine commercial banks.
• Storage Encryption: Personal data stored in phcsh's systems is encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to personal data is strictly limited to phcsh personnel with a legitimate operational need. All access is logged and reviewed.
• Two-Factor Authentication: phcsh account access is protected by OTP-based two-factor authentication for new device logins, reducing the risk of unauthorised account access even where credentials are compromised.
• Regular Security Audits: phcsh undergoes periodic third-party security audits and penetration testing to identify and remediate vulnerabilities in its systems.
• Incident Response: phcsh maintains a documented data breach incident response plan in compliance with NPC Circular 16-03 requirements.

8.2 While phcsh takes reasonable and appropriate measures to protect your personal data, no online system is completely immune from security threats. phcsh encourages players to maintain strong, unique passwords for their phcsh accounts and to keep their registered Philippine mobile number updated for OTP security.

9.1 phcsh retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Active Account Data: Retained for the duration of your phcsh account and for a period of five (5) years following permanent account closure, as required by PAGCOR and AMLC record-keeping obligations.
• KYC / Identity Documents: Retained for a minimum of five (5) years following account closure, in compliance with the Anti-Money Laundering Act's record-keeping requirements.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years as required by AMLC regulations and applicable tax law.
• Gaming Activity Logs: Retained for three (3) years following the recorded session, unless required to be retained longer in connection with a dispute or regulatory inquiry.
• Support Communications: Retained for two (2) years following the resolution of the relevant support interaction.
• Marketing Data: Retained until you withdraw consent for marketing communications or for three (3) years from your last platform interaction, whichever comes first.

9.2 Following the expiry of the applicable retention period, phcsh will securely delete, anonymise, or pseudonymise personal data in accordance with its data disposal procedures.

As a data subject under the Philippine Data Privacy Act of 2012, you hold the following rights in respect of your personal data held by phcsh. These rights are real and phcsh has established processes to honour them:

To exercise any of the above rights, please submit a written request to the phcsh Data Protection Officer at the contact details provided in Section 15. phcsh will acknowledge your request within three (3) business days and respond substantively within fifteen (15) business days, or within the period required by applicable NPC guidelines.

11.1 The phcsh platform is strictly intended for adults aged twenty-one (21) years and older, as required by PAGCOR regulations governing online gaming in the Philippines. phcsh does not knowingly collect personal data from any person under the age of twenty-one (21).

11.2 All phcsh registrations are subject to mandatory KYC age verification. Where phcsh discovers that personal data has been collected from a person under twenty-one (21) years of age, it will immediately suspend the relevant account, delete all associated personal data, and refund any deposits made, in accordance with its responsible gaming policies.

11.3 If you are a parent or guardian and believe that a minor has registered on the phcsh platform, please contact phcsh support immediately via live chat or at the email address provided in Section 15.

12.1 In the event of a personal data breach that is likely to give rise to a real risk of serious harm to affected data subjects, phcsh will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

12.2 Where a breach is likely to result in a high risk to the rights and freedoms of affected phcsh players, phcsh will notify affected individuals directly — including all registered phcsh account holders whose data is affected — with sufficient information to allow them to take appropriate protective measures, including changing passwords or monitoring for unauthorised account activity.

12.3 phcsh maintains a documented incident response plan for personal data breaches, which is reviewed and tested periodically. This plan includes procedures for containment, assessment, notification, and post-incident review.

13.1 phcsh's primary data processing infrastructure is located within the Philippines. In certain circumstances, personal data may be processed by phcsh's third-party service providers in locations outside the Philippines — for example, where phcsh utilises cloud infrastructure or game software providers with servers in other jurisdictions.

13.2 Where personal data is transferred outside the Philippines, phcsh ensures that such transfers are subject to appropriate safeguards, including: data processing agreements that impose equivalent data protection obligations on the receiving party; or transfers to countries whose data protection frameworks have been assessed as providing adequate protection by the NPC or comparable international authority.

13.3 phcsh will not transfer personal data to a third country or international organisation where the transfer would result in a lower standard of protection than that provided under the Data Privacy Act of 2012.

14.1 phcsh reviews and updates this Privacy Policy periodically to reflect changes in its data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. The most current version of this Policy, including its effective date and version number, is always published on the phcsh platform.

14.2 Where phcsh makes material changes to this Policy — including changes that affect the scope of data collected, the purposes for which it is used, or the rights available to data subjects — phcsh will provide advance notice to registered players via email or in-platform notification before the changes take effect.

14.3 Continued use of the phcsh platform following the effective date of an updated Policy constitutes acknowledgement of the updated terms. If you do not agree with a material change, you may request account closure prior to the effective date of the change.

For any privacy-related inquiries, data subject requests, or concerns about phcsh's data processing practices, please contact:

• Data Protection Officer (DPO): [email protected]
• General Support: [email protected]
• Business & Legal: [email protected]
• Live Chat: Available 24/7 on the phcsh platform

phcsh's Data Protection Officer will acknowledge data subject requests within three (3) business days of receipt and will provide a substantive response within fifteen (15) business days, or such other period as may be required under applicable NPC guidelines.