Privacy Policy — ph67

ph67 ("we," "us," "our," or "ph67") operates an online gaming platform accessible at ph67.one, offering Filipino players access to slot games, live casino, bingo, crash games, and related services. In providing these services, ph67 necessarily collects and processes personal data about the individuals who use the Platform.

This Privacy Policy describes in transparent detail the categories of personal data that ph67 collects, the purposes for which that data is processed, the legal basis supporting each processing activity, the parties with whom data may be shared, the period for which data is retained, and the rights available to data subjects under Philippine law.

By registering an account on ph67 or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately.

For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012), ph67 is the personal information controller responsible for the personal data collected through the Platform. ph67 has designated a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Privacy Policy and applicable Philippine data privacy law.

ph67 operates under PAGCOR's licensing and regulatory authority. PAGCOR may independently receive or access certain player data in its capacity as regulator, as described in Section 8 below.

ph67 collects the following categories of personal data from users of the Platform:

ph67 collects personal data through the following methods:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey;
• Automated collection: Technical and usage data collected automatically through server logs, cookies, and similar tracking technologies when you access or interact with the Platform;
• Third-party sources: Identity verification data received from KYC service providers engaged by ph67 to validate government-issued identity documents; payment processing data received from GCash, Maya, and other payment service providers as part of transaction processing; fraud detection signals from third-party risk management services.

ph67 does not purchase personal data from data brokers or compile personal profiles from unrelated third-party sources for marketing purposes.

ph67 processes your personal data for the following purposes, each supported by one or more legal bases under the Data Privacy Act of 2012:

• Account creation and management: Processing is necessary for the performance of a contract between ph67 and the account holder (RA 10173, Sec. 12(b));
• Payment processing and financial record-keeping: Necessary for contract performance and compliance with Philippine financial regulations;
• KYC and age verification: Required for compliance with PAGCOR licensing conditions and RA 9160 (Anti-Money Laundering Act), as amended — constituting a legal obligation (RA 10173, Sec. 12(c));
• Customer support delivery: Necessary for contract performance and ph67's legitimate interest in providing effective player assistance;
• Platform security and fraud prevention: ph67's legitimate interest in protecting the integrity of its platform and the financial interests of its players (RA 10173, Sec. 12(f));
• Regulatory reporting and compliance: Legal obligation to PAGCOR and, where applicable, the Anti-Money Laundering Council ("AMLC");
• Responsible gaming monitoring: ph67's legitimate interest and legal obligation to detect and respond to indicators of problem gambling;
• Personalized marketing and promotions: Based on your consent, which may be withdrawn at any time as described in Section 12.

As a PAGCOR-licensed operator, ph67 is required to conduct Know Your Customer ("KYC") verification for all account holders before full platform access — including withdrawals — is granted. KYC verification requires the collection, storage, and processing of identity documents and, in some circumstances, proof of address and source-of-funds documentation.

ph67 complies with Republic Act No. 9160, the Anti-Money Laundering Act of 2001, as amended by RA 9194, RA 10167, RA 10365, and RA 11521. Under these obligations, ph67 is required to:

• Maintain records of all covered and suspicious transactions for a minimum of five (5) years from the date of the transaction;
• Report covered transactions (single transactions or series of related transactions equivalent to ₱500,000 or more within five days) to the Anti-Money Laundering Council ("AMLC");
• Report suspicious transactions to the AMLC regardless of amount where there are reasonable grounds to suspect money laundering activity.

ph67 uses cookies and similar tracking technologies to operate, secure, and improve the Platform. Cookies are small data files stored on your device that help the Platform recognize your browser across sessions, maintain your login state, remember your preferences, and collect usage analytics.

ph67 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without preventing access to the Platform.
• Functional Cookies: Remember your preferences, such as language settings and game lobby view preferences. These enhance your experience but are not essential to Platform operation.
• Analytics Cookies: Collect aggregated, anonymized data about how users navigate the Platform, which pages are most visited, and where technical errors occur. This data helps ph67 improve Platform performance.
• Marketing Cookies: Used with your consent to deliver personalized promotional content based on your gaming activity and interests. You may withdraw consent for marketing cookies at any time.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. ph67 does not use third-party advertising networks that track you across external websites for advertising purposes unrelated to ph67.

ph67 does not sell your personal data. Personal data may be shared with the following categories of recipients only as necessary for the purposes described in this Policy:

• PAGCOR: As regulator, PAGCOR may require access to player data, transaction records, and gaming logs for licensing, audit, and compliance purposes. This sharing is a legal obligation.
• Anti-Money Laundering Council (AMLC): Transaction reports filed pursuant to RA 9160, as described in Section 6.
• Payment Service Providers: GCash, Maya, BPI, BDO, UnionBank, Metrobank, PNB, Coins.ph, and other payment processors receive the minimum personal and financial data necessary to execute deposit and withdrawal transactions.
• KYC and Identity Verification Providers: Third-party services engaged to verify government-issued identity documents. These providers act as data processors under written agreements with ph67 and may not use your data for their own purposes.
• Game Content Providers: Licensed game studios such as Evolution Gaming and Pragmatic Play may receive technical identifiers (session tokens, game IDs) necessary to deliver game content. These providers do not receive your full identity data.
• Fraud Prevention and Security Services: Third-party risk management platforms that assist ph67 in detecting fraudulent account activity, device spoofing, and multi-accounting.
• Legal and Law Enforcement Authorities: Where required by court order, subpoena, or applicable Philippine law, ph67 will disclose personal data to competent authorities. ph67 will not voluntarily disclose data to law enforcement absent a valid legal mandate.

All third-party data processors engaged by ph67 are subject to contractual obligations requiring them to process personal data only on ph67's documented instructions, maintain appropriate security measures, and comply with applicable Philippine privacy law.

Some of ph67's third-party service providers — including certain game content providers and technology infrastructure partners — are located outside the Philippines. When personal data is transferred to recipients in other jurisdictions, ph67 ensures that such transfers are conducted in compliance with the Data Privacy Act of 2012 and the National Privacy Commission's regulations on cross-border data transfers.

Specifically, ph67 relies on the following mechanisms for cross-border transfers:

• Written data processing agreements incorporating the NPC-approved standard contractual clauses or equivalent data protection commitments;
• Transfers to jurisdictions that the NPC has determined to provide an adequate level of data protection comparable to Philippine standards;
• Where neither of the above applies, ph67 will seek your explicit consent for the specific transfer where required.

ph67 does not transfer your full KYC documentation or financial account credentials to any recipient outside the Philippines except where strictly required for identity verification services engaged under appropriate contractual safeguards.

ph67 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply:

• Account registration and KYC data: Retained for the duration of the account and for a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AML obligations under RA 9160;
• Transaction and gaming records: Retained for a minimum of five (5) years from the date of the transaction, consistent with AML record-keeping requirements and potential dispute resolution needs;
• Customer support communications: Retained for three (3) years from the date of the final communication in a support thread, unless the matter relates to an ongoing dispute or regulatory inquiry;
• Marketing consent records: Retained for the duration of your consent and for three (3) years following withdrawal of consent, to demonstrate compliance with consent obligations;
• Technical and log data: Typically retained for twelve (12) months from collection, unless required for longer retention in connection with a security incident or legal matter.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymized in accordance with ph67's data disposal procedures. Anonymized data may be retained indefinitely for aggregated analytics purposes without constituting personal data under the Data Privacy Act.

ph67 implements a range of technical and organizational security measures designed to protect personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and the ph67 Platform is encrypted using TLS 1.2 or higher. Sensitive data fields including passwords and payment details are encrypted at rest;
• Access Controls: Access to personal data is restricted to ph67 staff and contractors who require it for specific, authorized purposes. Access rights are reviewed periodically and revoked immediately upon termination of employment or contract;
• Two-Factor Authentication: ph67 offers two-factor authentication (2FA) for player accounts and mandates 2FA for internal staff systems that process personal data;
• Security Monitoring: ph67's infrastructure is monitored 24/7 for anomalous access patterns and potential intrusion events;
• Penetration Testing: ph67 engages independent security firms to conduct periodic penetration testing of the Platform's technical infrastructure.

While ph67 takes data security seriously and implements the measures described above, no digital transmission or storage system is completely impenetrable. ph67 cannot guarantee absolute security against all possible threats. You can contribute to the security of your data by maintaining the confidentiality of your ph67 account credentials and reporting any suspected unauthorized account activity immediately.

Under the Data Privacy Act of 2012, Philippine data subjects have the following rights with respect to their personal data held by ph67:

To exercise any of the above rights, submit a written request to ph67's Data Protection Officer at the contact details provided in Section 15. ph67 will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days, unless the complexity of the request warrants an extension, in which case you will be notified of the extended timeline.

ph67 will verify your identity before processing any data subject rights request to prevent unauthorized disclosure of personal data. Requests that cannot be fulfilled due to conflicting legal obligations (such as AML retention requirements) will be accompanied by a clear explanation of the applicable legal basis for the refusal.

The ph67 Platform is strictly intended for individuals who are twenty-one (21) years of age or older. ph67 does not knowingly collect personal data from individuals under the age of 21. This restriction is a mandatory condition of ph67's PAGCOR operating authorization and applies without exception.

ph67 employs the following age protection measures:

• All account registration forms require confirmation of age as a precondition to creating an account;
• KYC verification, which is mandatory for full account access, requires submission of a government-issued identity document confirming date of birth;
• Accounts where submitted KYC documents reveal that the holder is under the age of 21 will be immediately suspended and any deposited funds returned to the originating payment method.

Parents and guardians who believe a minor may have accessed the ph67 Platform using their identity or payment credentials should contact ph67 support immediately through the live chat facility or by email. ph67 takes such reports seriously and will act promptly to secure the account pending investigation.

ph67 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidelines, or PAGCOR regulatory requirements. The effective date of the current version is indicated at the top of this document.

When ph67 makes material changes to this Policy — that is, changes that meaningfully alter how we collect, use, or share your personal data — we will provide notice through one or more of the following channels: a notification in your ph67 account upon login, an SMS to your registered Philippine mobile number, or an email to your registered address.

Your continued use of the Platform after the updated Policy takes effect constitutes your acceptance of the revised terms. If you do not agree with any material change, you may close your ph67 account and exercise your data subject rights as described in Section 12 above.

For any question, concern, or request relating to this Privacy Policy or ph67's data processing activities, you may contact ph67's Data Protection Officer through the following channels:

If you are not satisfied with ph67's response to a privacy concern or data subject rights request, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines at privacy.gov.ph or by contacting the NPC through its official channels.

This Privacy Policy was last reviewed and updated on January 1, 2026. All prior versions of this Policy are superseded by this document. Continued use of the ph67 Platform constitutes acceptance of this Privacy Policy.