phmaya Privacy Policy

1 Introduction

phmaya ("phmaya," "we," "us," or "our") is committed to protecting the privacy and personal data of all users of the phmaya online gaming platform accessible at phmaya.app (the "Platform"). This Privacy Policy describes how phmaya collects, uses, stores, shares, and protects your personal information when you access or use the Platform.

This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. As a data subject, you are entitled to the rights described in this policy, and phmaya is committed to upholding those rights in full.

This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which form part of the overall agreement between you and phmaya. Capitalised terms not defined in this policy have the meanings given to them in the Terms & Conditions.

By registering an account, logging in, or otherwise using the phmaya Platform, you confirm that you have read this Privacy Policy and consent to the processing of your personal data as described herein. If you are under 21 years of age, you are not permitted to use the Platform and must not submit any personal data to phmaya.

2 Personal Data We Collect

phmaya collects personal data that is necessary for the operation of the Platform, the verification of player identity, the processing of financial transactions, and the fulfilment of our regulatory obligations. The categories of personal data we collect include:

2.1 Identity Data

• Full legal name as it appears on your government-issued identification
• Date of birth (used to verify that you are at least 21 years of age)
• Gender
• Nationality and country of residence
• Government-issued identification number (e.g., Philippine passport number, driver's license number, SSS/UMID number)
• Copies of identity documents submitted for KYC verification

2.2 Contact Data

• Email address
• Mobile phone number
• Residential address (including barangay, city/municipality, province, and postal code)

2.3 Financial Data

• Payment method details (e.g., GCash account number, PayMaya/Maya account number, bank account details for BPI, BDO, or Metrobank)
• Transaction history, including deposits, withdrawals, wagers, and winnings
• Source of funds documentation where required for AML compliance

2.4 Account & Gaming Data

• Username and encrypted password
• Account registration date and history
• Game play history, including games played, bet amounts, outcomes, and session durations
• Bonus and promotion usage history
• Responsible gaming settings and self-exclusion records

2.5 Technical Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Unique device identifiers
• Log data, including access times, pages visited, and actions taken on the Platform

2.6 Communications Data

• Records of communications between you and phmaya customer support
• Feedback, complaints, and survey responses submitted by you
• Marketing communication preferences

3 How We Collect Your Data

phmaya collects personal data through the following means:

3.1 Direct Collection

We collect data directly from you when you register an account on the Platform, complete the KYC verification process, make a deposit or withdrawal, contact our customer support team, respond to surveys or promotions, or update your account settings.

3.2 Automated Collection

When you access and use the phmaya Platform, we automatically collect certain technical data through cookies, web beacons, pixel tags, and similar tracking technologies. This includes your IP address, device information, browser type, and your activity on the Platform. Please refer to Section 7 of this policy for more information on our use of cookies.

3.3 Third-Party Sources

phmaya may receive personal data about you from third-party sources in the following circumstances:

• KYC and identity verification providers — third-party services that assist us in verifying your identity and age.
• Payment processors — GCash, PayMaya/Maya, BPI, BDO, Metrobank, and other payment service providers may share transaction-related data with us.
• Fraud prevention and AML screening services — third-party services that help us detect and prevent fraudulent activity and money laundering.
• Regulatory and law enforcement authorities — where we are required by law to receive or share information with government bodies.

4 How We Use Your Personal Data

phmaya uses your personal data for the following purposes:

phmaya will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by applicable law.

5 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phmaya processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary for the performance of the contract between you and phmaya — specifically, to provide you with access to the Platform, process your transactions, and manage your account.
• Legal obligation: Processing is necessary for phmaya to comply with applicable laws and regulations, including KYC requirements, anti-money laundering obligations, and gaming regulatory requirements.
• Legitimate interests: Processing is necessary for phmaya's legitimate business interests, including fraud prevention, platform security, and improving our services, provided that such interests are not overridden by your rights and interests.
• Consent: For certain processing activities — such as sending you marketing communications or using non-essential cookies — phmaya relies on your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Sharing Your Personal Data

phmaya does not sell, rent, or trade your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

6.1 Service Providers

phmaya engages trusted third-party service providers to assist in operating the Platform. These include KYC and identity verification providers, payment processors (GCash, PayMaya/Maya, BPI, BDO, Metrobank), cloud hosting and infrastructure providers, customer support platform providers, and fraud detection and AML screening services. All service providers are contractually bound to process your data only on phmaya's instructions and in accordance with applicable data protection law.

6.2 Regulatory and Law Enforcement Authorities

phmaya may disclose your personal data to government agencies, regulatory bodies, law enforcement authorities, or courts where required to do so by applicable Philippine law, court order, or regulatory directive. This includes disclosures required under anti-money laundering regulations and gaming regulatory requirements.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of phmaya's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to how your data is processed as a result.

6.4 With Your Consent

phmaya may share your personal data with other third parties where you have given your explicit consent to such sharing.

7 Cookies & Tracking Technologies

phmaya uses cookies and similar tracking technologies on the Platform to enhance your experience, maintain your session, and gather analytics data. The types of cookies we use are as follows:

7.1 Essential Cookies

These cookies are strictly necessary for the Platform to function. They enable core features such as user authentication, session management, and security. Essential cookies cannot be disabled without significantly impairing your ability to use the Platform.

7.2 Analytics Cookies

phmaya uses analytics cookies to understand how players interact with the Platform — for example, which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used in aggregate and anonymised form to improve the Platform's performance and user experience.

7.3 Functional Cookies

Functional cookies allow the Platform to remember your preferences, such as your preferred language, display settings, and responsible gaming limits. These cookies improve your experience but are not strictly essential.

7.4 Marketing Cookies

With your consent, phmaya may use marketing cookies to deliver relevant promotional content and offers based on your activity on the Platform. You may withdraw your consent to marketing cookies at any time through your account settings or by adjusting your browser's cookie settings.

8 Data Retention

phmaya retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with Philippine AML and gaming regulatory requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction, as required by applicable financial regulations.
• Gaming activity data: Retained for the duration of your account and for a minimum of three (3) years following account closure.
• Customer support communications: Retained for a minimum of two (2) years from the date of the communication.
• Marketing preferences: Retained until you withdraw your consent or close your account, whichever is earlier.
• Technical and log data: Retained for up to twelve (12) months from the date of collection, unless required for longer periods for security or legal purposes.

Where phmaya is required by law to retain data for a longer period, the statutory retention period will apply. Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised.

9 Data Security

phmaya takes the security of your personal data seriously and implements a range of technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the phmaya Platform.
• Encryption at rest for sensitive data stored on phmaya's servers, including passwords (which are stored as salted hashes and never in plain text) and financial data.
• Access controls limiting access to personal data to authorised phmaya personnel and service providers on a strict need-to-know basis.
• Regular security assessments and penetration testing of the Platform's infrastructure.
• Multi-factor authentication options available to players to enhance account security.
• Incident response procedures to detect, investigate, and respond to data security incidents promptly.

While phmaya employs robust security measures, no system is completely immune to security risks. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phmaya will notify you and the National Privacy Commission of the Philippines in accordance with applicable law.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmaya:

• Right to be informed: You have the right to be informed about how your personal data is collected, used, and processed. This Privacy Policy fulfils that obligation.
• Right of access: You have the right to request a copy of the personal data phmaya holds about you, along with information about how it is processed.
• Right to rectification: You have the right to request correction of any inaccurate or incomplete personal data phmaya holds about you. You may update certain information directly through your account settings.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phmaya's legal retention obligations.
• Right to object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on phmaya's legitimate interests.
• Right to data portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe that phmaya has processed your personal data in violation of the Data Privacy Act.

To exercise any of the above rights, please contact phmaya's Data Protection Officer using the contact details provided in Section 14 of this policy. phmaya will respond to all data subject requests within the timeframes prescribed by applicable law.

11 Children's Privacy

The phmaya Platform is strictly intended for adults aged 21 years and above. phmaya does not knowingly collect personal data from any person under the age of 21. If you are under 21 years of age, you must not register an account, use the Platform, or submit any personal data to phmaya.

If phmaya becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete that data and close the associated account. If you believe that phmaya may have collected data from a minor, please contact our support team immediately.

phmaya strongly recommends that parents and guardians who share devices with minors implement appropriate parental controls to prevent access to the phmaya Platform.

12 Third-Party Links

The phmaya Platform may contain links to third-party websites or services for informational purposes. phmaya is not responsible for the privacy practices or content of any third-party websites. This Privacy Policy applies solely to the phmaya Platform at phmaya.app. We encourage you to review the privacy policies of any third-party websites you visit.

phmaya does not endorse and is not affiliated with any third-party websites that may be linked from the Platform. Accessing third-party websites is entirely at your own risk.

13 Changes to This Privacy Policy

phmaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, phmaya will notify registered players via email or through a prominent notice on the Platform prior to the changes taking effect.

The date of the most recent revision is always displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how phmaya protects your personal data. Your continued use of the Platform following the posting of an updated Privacy Policy constitutes your acceptance of the changes.

If you do not agree with any changes to this Privacy Policy, you must stop using the Platform and may request account closure in accordance with the Terms & Conditions.

14 Contact Us & Data Protection Officer

phmaya has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. phmaya encourages you to contact us first so we can address your concern directly and promptly.