phlogo Privacy Policy

📌 1. Introduction

phlogo is committed to protecting the privacy and personal data of all individuals who interact with the platform. We recognise that the data you share with phlogo — your name, mobile number, financial information, gaming activity — is sensitive, and we treat it with the level of care it deserves.

This Policy has been prepared in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations ("IRR") as administered by the National Privacy Commission ("NPC"). It reflects phlogo's commitment to lawful, fair, and transparent personal data processing.

This Policy applies to all personal data collected through the phlogo website at phlogo.app, the phlogo mobile application, live chat, email correspondence, and any other channel through which phlogo receives personal data from or about you.

🏢 2. Data Controller Information

For the purposes of the Data Privacy Act of 2012, phlogo is the Personal Information Controller responsible for your personal data. phlogo has appointed a Data Protection Officer ("DPO") who oversees compliance with data privacy obligations and serves as the primary point of contact for data subject rights requests and privacy-related inquiries.

Contact information for the phlogo Data Protection Officer is provided in Section 16 of this Policy. All data subject rights requests and privacy concerns should be directed to the DPO.

🗂️ 3. Categories of Personal Data We Collect

phlogo collects the following categories of personal data, depending on how you interact with the platform:

Category	Examples	Collection Point
Identity Data	Full legal name, date of birth, government-issued ID number (passport, PhilSys, SSS, driver's licence)	Registration, KYC verification
Contact Data	Philippine mobile number, email address, residential address	Registration, account updates
Financial Data	GCash number, PayMaya number, bank account details (BPI, BDO, Metrobank), card details (masked), transaction history	Deposits, withdrawals, KYC
Gaming Activity Data	Game history, bet amounts, win/loss records, session durations, bonus usage	Platform usage
Technical Data	IP address, device type, browser type, operating system, session identifiers, geolocation (country/city level)	Automatic collection
Communications Data	Live chat transcripts, email correspondence, support ticket content	Customer support interactions
Responsible Gaming Data	Self-exclusion status, deposit limit settings, session timer preferences, problem gambling indicators	Responsible gaming tools

3.1 Special Categories of Personal Data

phlogo does not intentionally collect special categories of personal data (such as health data, biometric data, or political opinions) except where strictly required by applicable law — for example, health-related information provided voluntarily in the context of a responsible gaming self-exclusion request. Such data is handled with heightened security controls and is processed only for the specific purpose for which it was provided.

📥 4. How We Collect Your Personal Data

phlogo collects personal data through the following methods:

• Direct Provision: Information you actively provide during account registration, KYC document submission, deposit or withdrawal requests, contact form submissions, live chat, or email correspondence.
• Automated Collection: Technical data collected automatically when you visit phlogo.app or use the phlogo mobile application, including cookies, server logs, session tokens, and device fingerprint data.
• Third-Party Sources: Identity verification data from KYC service providers, payment confirmation data from GCash, PayMaya, and banking institutions, and fraud prevention data from anti-fraud service providers authorised to share data with phlogo under appropriate data sharing agreements.
• Gameplay: Gaming activity and transaction data generated automatically as a result of your use of phlogo's games and wagering services.

🎯 5. Purposes of Personal Data Processing

phlogo processes your personal data for the following purposes:

• Account Administration: Creating, managing, and maintaining your phlogo account, including authentication, password recovery, and session management.
• Identity Verification (KYC): Verifying your identity and age (21+ requirement) in compliance with Philippine gambling regulations and anti-money laundering laws.
• Payment Processing: Processing deposits, withdrawals, and refunds through your chosen payment method, including GCash, PayMaya, and Philippine banking channels.
• Service Delivery: Providing access to phlogo's casino games, live tables, bingo, sports betting, sabong, and associated services.
• Responsible Gaming: Monitoring gaming activity to identify potential problem gambling indicators; administering self-exclusion, deposit limits, and session timers in compliance with responsible gaming obligations.
• Anti-Fraud and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorised account access, and other security incidents.
• Regulatory Compliance: Complying with legal obligations including PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) reporting obligations, and NPC data privacy requirements.
• Customer Support: Responding to your queries, complaints, and support requests submitted via live chat or email.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game offerings, and user experience.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Players who have not opted out of marketing communications. You may opt out at any time through Account Settings.

⚖️ 6. Legal Basis for Processing

Under the Data Privacy Act of 2012, phlogo processes your personal data on the following legal bases:

• Consent: For marketing communications and non-essential cookies, phlogo relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Contract Performance: Processing necessary to enter into and perform the phlogo User Agreement, including account creation, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR regulations, AMLA obligations, and NPC directives.
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement, where such processing does not override your fundamental rights and freedoms as a data subject.

🤝 7. Data Sharing and Third-Party Disclosure

7.1 Authorised Third-Party Recipients

phlogo may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard, and cryptocurrency processing partners, for the purpose of processing financial transactions on your behalf.
• Identity Verification Providers: KYC service providers engaged to verify identity documents and confirm age eligibility in compliance with regulatory requirements.
• Anti-Fraud and Security Providers: Third-party services engaged to detect fraudulent activity, prevent money laundering, and maintain platform security.
• Game Providers: Licensed game studios (such as PG Soft, JILI, Pragmatic Play, and Evolution) who may receive a pseudonymised player identifier and wagering data necessary to deliver and audit game outcomes. These providers do not receive your name, contact details, or financial data.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where phlogo is legally required to disclose data.
• Cloud and Infrastructure Providers: Hosting and cloud service providers engaged to operate phlogo's technical infrastructure, under contractual data processing agreements that bind them to phlogo's security and confidentiality standards.

7.2 No Sale of Personal Data

phlogo does not sell, rent, lease, or otherwise transfer your personal data to any third party for that party's own marketing or commercial purposes. Any transfer of data to third parties is conducted solely for the purposes specified in this Policy and subject to appropriate legal safeguards.

🗓️ 8. Data Retention

phlogo retains personal data for no longer than is necessary for the purposes for which it was collected, unless a longer retention period is required by law. The following general retention guidelines apply:

• Account and Identity Data: Retained for the duration of your phlogo account plus five (5) years following permanent account closure, in accordance with AMLA record-keeping requirements and PAGCOR regulatory obligations.
• Financial and Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, in compliance with AMLA obligations.
• KYC Documents: Retained for five (5) years following account closure or the last relevant transaction, whichever is later.
• Gaming Activity Data: Retained for five (5) years from the date of the relevant gaming session, for regulatory reporting and dispute resolution purposes.
• Customer Support Records: Retained for three (3) years from the date of the interaction.
• Marketing Preferences: Retained until you withdraw consent or close your account, whichever occurs first.

Following the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where data is anonymised, the anonymised records may be retained indefinitely for statistical and analytical purposes, as they no longer constitute personal data under the DPA.

🔐 9. Data Security Measures

phlogo implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phlogo's servers
• Encryption of sensitive personal data fields (including financial data) at rest using industry-standard algorithms
• Role-based access controls limiting internal access to personal data strictly to authorised personnel with a documented business need
• Multi-factor authentication requirements for all phlogo staff accessing systems containing personal data
• Regular penetration testing, vulnerability scanning, and third-party security audits of phlogo's infrastructure
• Formal data breach response procedures with defined escalation, notification, and remediation timelines
• Employee data privacy training conducted on an annual basis and at onboarding

While phlogo employs robust security measures, no internet-based platform can guarantee absolute security. You are encouraged to protect your own account by using a strong, unique password, enabling two-factor authentication, and reporting any suspected unauthorised access immediately to phlogo's support team.

🍪 10. Cookies and Similar Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device by websites you visit. phlogo uses cookies and similar tracking technologies (such as web beacons and session tokens) to operate the platform effectively and to improve your experience.

10.2 Types of Cookies Used by phlogo

• Strictly Necessary Cookies: Required for core platform functionality including session management, authentication, and security. These cannot be disabled without preventing core features from working.
• Performance Cookies: Collect anonymised data about how Players use phlogo (e.g., which games are most accessed, page load times) to help phlogo improve the platform. No personally identifiable information is collected by these cookies.
• Functional Cookies: Remember your preferences such as language settings and game lobby filters to enhance your experience across sessions.
• Marketing Cookies: Used only with your explicit consent, to display relevant phlogo promotional content. You may withdraw consent for marketing cookies at any time through your browser settings or phlogo's cookie preference centre.

👤 11. Your Rights as a Data Subject

Under Republic Act No. 10173 (Data Privacy Act of 2012), you hold the following rights with respect to your personal data processed by phlogo. You may exercise any of these rights by submitting a written request to the phlogo DPO using the contact information in Section 16.

• Right to Access: You have the right to request confirmation of whether phlogo processes your personal data and to receive a copy of that data in an intelligible format.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held by phlogo.
• Right to Erasure (Right to be Forgotten): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phlogo's overriding legal retention obligations under AMLA and PAGCOR regulations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Blocking: You have the right to request that processing of your personal data be suspended pending resolution of a rectification or objection request.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phlogo has violated your data privacy rights.

🔞 12. Minors and Age Restrictions

phlogo's services are strictly intended for individuals who are twenty-one (21) years of age or older, in accordance with Philippine gambling regulations. phlogo does not knowingly collect, process, or retain personal data from individuals under the age of 21.

If phlogo becomes aware that personal data has been collected from a person under 21 years of age, the associated account will be immediately closed and all personal data relating to that individual will be deleted, except where retention is required to satisfy legal obligations or to prevent future underage access attempts.

Parents or guardians who suspect that a minor has registered on phlogo are encouraged to contact the phlogo DPO immediately using the contact information provided in Section 16 of this Policy.

🌏 13. Cross-Border Data Transfers

phlogo may transfer your personal data to service providers and infrastructure partners located outside the Philippines, including game studio providers and cloud infrastructure partners. Where such transfers occur, phlogo ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to the protections afforded under the Data Privacy Act of 2012.

Safeguards employed for cross-border data transfers may include standard contractual clauses, data processing agreements requiring adherence to DPA standards, or transfers to recipients in jurisdictions that the NPC has recognised as providing adequate levels of data protection. phlogo will not transfer personal data internationally in the absence of such safeguards.

🚨 14. Personal Data Breach Notification Protocol

In the event of a personal data breach — defined as any incident resulting in the unauthorised acquisition, use, disclosure, modification, destruction, or loss of personal data — phlogo will implement the following protocol:

• Internal Containment: Upon discovery of a breach, phlogo's security team will immediately act to contain the incident and prevent further unauthorised access or data loss.
• NPC Notification: Where the breach is likely to give rise to a real risk of serious harm to the affected data subjects, phlogo will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.
• Individual Notification: Affected phlogo Players will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The notification will describe the nature of the breach, the data likely affected, phlogo's containment and remediation actions, and guidance on steps you may take to protect yourself.

✏️ 15. Amendments to This Privacy Policy

phlogo reserves the right to update or amend this Privacy Policy at any time to reflect changes in data processing activities, applicable laws, or platform operations. Material changes will be communicated to registered phlogo Players by posting a prominent notice on the platform and, where practicable, by notifying your registered email address or mobile number in advance of the changes taking effect.

The version of this Policy displaying the most recent "Effective Date" at the top of the page is the currently operative version. Your continued use of phlogo following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with any amendment, you may close your account and request deletion of your personal data in accordance with Section 11 of this Policy, subject to overriding legal retention obligations.

📬 16. Contact the phlogo Data Protection Officer

For all data privacy inquiries, data subject rights requests, privacy complaints, or concerns about phlogo's personal data practices, please contact the phlogo Data Protection Officer through the following channels:

• Live Chat (Preferred): Available 24/7 on the phlogo platform — request to speak with or be referred to the Data Protection Officer team. Average response time under 5 minutes.
• Email: support phlogo app — please include "Data Privacy Request" or "DPO Inquiry" in your subject line. Responses within 4 business hours.

When submitting a data subject rights request, please include your full registered name, your registered mobile number or email address, and a clear description of the right you wish to exercise or the concern you wish to raise. This helps phlogo's DPO team process your request accurately and without unnecessary delay.

If you are dissatisfied with phlogo's handling of your data privacy concern after raising it with the DPO, you have the right to escalate your complaint directly to the National Privacy Commission (NPC) of the Philippines.