ph38 Privacy Policy

ph38 is the operator of the online gaming platform accessible at ph38.one (the "Platform"), offering live dealer casino games, slot games, fish shooting, bingo, and sports betting services to eligible adult players in the Philippines.

For the purposes of this Privacy Policy, ph38 acts as the data controller in respect of the personal data it processes about registered players, site visitors, and customer support contacts. As data controller, ph38 determines the purposes and means of personal data processing and is responsible for ensuring that processing is carried out in accordance with applicable data protection laws, including the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its implementing rules and regulations.

Questions or requests relating to this Privacy Policy or to your personal data may be directed to ph38 Customer Support via live chat (available 24/7 on-site) or by email at [email protected].

ph38 collects personal data through your registration, use of the Platform, interactions with customer support, and through automated technologies. The categories of data collected are set out below.

Where ph38 processes information that may qualify as sensitive personal information under the Data Privacy Act of 2012 — such as government-issued ID information collected for KYC purposes — such processing is carried out solely to comply with applicable legal obligations and to verify player identity. ph38 does not process sensitive personal information for marketing or profiling purposes.

In addition to the data categories above, you may choose to provide additional information to ph38 when using responsible gaming tools — for example, when setting self-exclusion periods or deposit limits through your account dashboard. This information is used solely to operate those protective features on your behalf.

ph38 uses your personal data for the following purposes:

• Account creation and management: Processing your registration, verifying your identity and age, maintaining your account, and sending service communications essential to your account (e.g., OTP verification, withdrawal confirmations, security alerts).
• Service delivery: Providing access to ph38's game lobby, processing deposits and withdrawals, crediting winnings, administering bonuses and promotions, and providing customer support.
• Legal and regulatory compliance: Meeting anti-money-laundering (AML) obligations, Know Your Customer (KYC) requirements, age verification mandates, and any other compliance obligation applicable to online gaming operations in the Philippines.
• Fraud prevention and security: Detecting and preventing unauthorized access, fraud, money laundering, bonus abuse, and other prohibited conduct; monitoring for suspicious activity patterns; and protecting the security of the ph38 Platform and its players.
• Responsible gaming: Administering self-exclusion requests, deposit limits, and session loss caps; monitoring gaming patterns that may indicate problematic behaviour; and contacting players where concern for player welfare warrants it.
• Platform improvement: Analyzing aggregated, anonymized usage data to improve platform functionality, game selection, and user experience. Individual players are not identified in these analyses.
• Marketing communications: Where you have provided consent, sending promotional materials about ph38 offers, new game releases, and loyalty programs. You may withdraw this consent at any time.
• Dispute resolution: Maintaining records sufficient to investigate and resolve disputes, verify transaction history, and respond to regulatory inquiries.

ph38 processes your personal data under one or more of the following legal bases as recognized under the Data Privacy Act of 2012 and applicable Philippine data protection regulations:

• Contractual necessity: Processing required to perform the agreement between you and ph38 — including account management, payment processing, and game access — is carried out on the basis of contractual necessity.
• Legal obligation: Processing required to comply with applicable laws and regulations — including AML/KYC requirements, age verification, and tax reporting obligations — is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, platform security, dispute resolution, and internal analytics is carried out on the basis of ph38's legitimate interests, where those interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications is carried out on the basis of your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

ph38 does not sell or trade your personal data. Your data may be shared with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and 7-Eleven CLiQQ, to process your deposits and withdrawals. These providers handle your payment data under their own privacy policies and applicable financial data security standards.
• Identity verification providers: Third-party KYC service providers engaged by ph38 to verify identity documents and check against sanctions or exclusion lists, as required by applicable law.
• Game software providers: Providers of the game software powering the ph38 Platform may receive technical session data (such as player ID and wager amounts) required to operate game sessions. Providers do not receive your full personal profile.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and data backup service providers who process data on ph38's behalf under data processing agreements that restrict their use of your data.
• Regulatory and law enforcement authorities: Where ph38 is required by law, court order, or regulatory directive to disclose personal data — including to PAGCOR, the Anti-Money Laundering Council (AMLC), or law enforcement agencies — ph38 will comply with such requirements.
• Professional advisors: Legal, financial, and audit advisors who require access to account or transaction data in the course of providing professional services to ph38, subject to professional confidentiality obligations.

ph38 uses cookies and similar tracking technologies to operate the Platform, improve performance, and analyze usage. A summary of the cookie types used is set out below.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality or performance of parts of the ph38 Platform.

ph38 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law. The general retention guidelines applied by ph38 are as follows:

• Account and identity data: Retained for the lifetime of the Account and for a minimum of five (5) years following Account closure, to meet anti-money-laundering record-keeping requirements under Philippine law.
• Financial transaction records: Retained for a minimum of five (5) years from the date of transaction, in compliance with applicable AML and tax record-keeping requirements.
• Gaming activity data: Retained for the lifetime of the Account and for a period not exceeding five (5) years following Account closure, for dispute resolution and regulatory purposes.
• Customer support communications: Retained for three (3) years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of the Account and for one (1) year following consent withdrawal or Account closure, to demonstrate the legal basis for any marketing communications sent.
• Technical and log data: Retained for up to twelve (12) months from collection, after which it is deleted or anonymized unless required for ongoing security investigation or legal proceedings.

At the end of applicable retention periods, personal data is securely deleted or rendered permanently anonymous so that it can no longer be associated with any individual.

ph38 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. These measures include:

• AES-256 encryption for personal data stored in ph38's systems;
• 256-bit SSL/TLS encryption for all data transmitted between your device and the ph38 Platform;
• Role-based access controls ensuring that only authorized personnel with a documented need can access personal data;
• OTP two-factor verification for sensitive account actions;
• Regular security assessments and penetration testing of platform infrastructure;
• Segregation of player funds from operational funds, with financial data subject to additional security controls;
• Employee training on data protection obligations and security practices.

In the event of a personal data breach that is likely to result in a risk to your rights, ph38 will notify the National Privacy Commission (NPC) and affected individuals as required by the Data Privacy Act of 2012 and its implementing rules.

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ph38:

To exercise any of these rights, contact ph38 live chat support (24/7) or email [email protected]. ph38 will respond to all data rights requests within thirty (30) days of receipt. Where a request is complex or numerous, the response period may be extended by up to a further two months, with notification provided within the initial thirty-day window.

The ph38 Platform is strictly for adults aged twenty-one (21) years and above in accordance with Philippine gaming law. ph38 does not knowingly collect or process personal data from individuals under the age of 21.

If ph38 discovers or is notified that personal data has been collected from a person under the age of 21, that Account will be immediately suspended, all associated personal data will be deleted to the extent legally permissible, and any deposited funds will be returned subject to applicable AML review. Age verification is a mandatory step in the ph38 registration and withdrawal processes precisely to prevent underage access to the Platform.

Parents or guardians who believe a minor may have registered with ph38 should contact ph38 live chat support immediately with relevant information to expedite investigation and Account closure.

ph38 operates primarily in and for the Philippine market. Some third-party service providers — particularly cloud infrastructure and game software providers — may process data in locations outside the Philippines. Where personal data is transferred outside the Philippines, ph38 ensures that appropriate safeguards are in place to protect your data to at least the standard required by the Data Privacy Act of 2012.

Appropriate safeguards for international transfers may include standard contractual clauses, service provider certifications, or adequacy determinations by the National Privacy Commission. ph38 does not transfer personal data to jurisdictions where adequate data protection cannot be assured.

The ph38 Platform does not include links to external websites or third-party platforms as part of its standard navigation. Where game software provided by third-party game studios is accessed through ph38, those studios may receive limited technical session data necessary to operate the game as described in Section 5 of this Policy. ph38 is not responsible for the privacy practices of third-party game studios beyond the scope of ph38's contractual data processing agreements with those providers.

ph38's payment providers — including GCash, Maya, BPI, BDO, Metrobank, and 7-Eleven — have their own privacy policies governing how they handle financial transaction data. ph38 recommends reviewing those policies for information on how your payment data is handled on those providers' systems.

ph38 may send you promotional communications — including information about bonuses, new games, reload offers, and platform news — where you have provided explicit consent to receive such communications at the time of registration or subsequently through your Account settings.

You may withdraw consent to receive marketing communications at any time by:

• Updating your communication preferences in your ph38 Account settings;
• Contacting ph38 live chat support with a request to opt out; or
• Emailing [email protected] with the subject line "Marketing Opt-Out."

Withdrawal of consent for marketing will take effect within a reasonable processing period and will not affect your ability to continue using the ph38 Platform or receiving essential service communications related to your Account (such as transaction confirmations, OTPs, and security alerts, which are not marketing communications and are sent regardless of marketing preferences).

ph38 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or Platform features. The "Last Updated" date at the top of this Policy indicates when the current version became effective.

For material changes — those that significantly affect how your personal data is used or your rights under this Policy — ph38 will provide advance notice to registered Players via on-site notification or by the contact details associated with your Account, before the change takes effect. Your continued use of the ph38 Platform following notification of a material change constitutes acceptance of the revised Privacy Policy.

Minor or administrative updates that do not materially alter the rights or obligations described in this Policy may be made without prior individual notification. ph38 recommends reviewing this page periodically to stay informed of any updates.

If you have any questions, concerns, or requests relating to this Privacy Policy or to ph38's handling of your personal data, please contact us through any of the following channels:

• Live Chat Support: Available directly on the ph38 Platform, 24 hours a day, 7 days a week — including Philippine public holidays. Average response time: 3–5 minutes.
• Email: [email protected] — responses are provided within one (1) business day for privacy-related enquiries.

When contacting ph38 regarding a data protection matter, please provide your registered mobile number and a clear description of your request. This helps ph38 verify your identity and process your request efficiently.

Formal complaints relating to ph38's data processing practices that cannot be resolved through ph38's internal process may be lodged with the National Privacy Commission (NPC) of the Philippines. Information on filing a complaint with the NPC is available through the NPC's official channels.