phtaya1 Privacy Policy

This Privacy Policy applies to all personal data collected and processed by phtaya1 in connection with your access to and use of the phtaya1 online gaming platform accessible at phtaya1.co, including all associated services, account management functions, payment processing operations, customer support interactions, and marketing communications.

By registering a phtaya1 account or continuing to use our platform after this Policy has been published or updated, you acknowledge that you have read and understood the terms of this Privacy Policy and agree to the collection and processing of your personal data as described herein.

This Policy should be read alongside phtaya1's Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall framework governing your relationship with phtaya1.

For the purposes of the Philippine Data Privacy Act of 2012 and this Privacy Policy, phtaya1 is the personal information controller responsible for the collection, use, storage, and disclosure of the personal data of all registered players and platform users.

Questions, requests, or complaints regarding the handling of your personal data by phtaya1 may be directed to our Data Protection Officer at the contact details provided in Section 17 of this Policy.

phtaya1 collects personal data in several categories depending on the nature of your interaction with the platform. The specific data collected in each category is set out below.

phtaya1 does not intentionally collect sensitive personal information as defined under the Data Privacy Act (such as health data, religious beliefs, or political affiliations) unless it is provided voluntarily in the context of a responsible gaming support interaction, in which case it is treated with the highest level of confidentiality.

phtaya1 collects personal data through the following channels and mechanisms:

• Direct input from you — data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or submitting a responsible gaming request.
• Automated technical collection — data gathered automatically when you access or interact with the phtaya1 platform, including IP addresses, device identifiers, browser information, and session activity, through server logs and platform analytics.
• Cookies and similar tracking technologies — data collected through cookies, web beacons, and local storage as described in Section 8 of this Policy.
• Third-party payment processors — transaction verification data received from GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank when you conduct financial transactions through the phtaya1 platform.
• Identity verification service providers — confirmation of identity and document authenticity from third-party KYC verification services engaged by phtaya1.
• Regulatory and compliance databases — screening results from anti-money laundering and sanctions databases checked as required by Philippine law.

phtaya1 processes your personal data only where a lawful basis for processing exists under the Philippine Data Privacy Act. The applicable legal bases for our processing activities are as follows:

• Contractual necessity: Processing required to create and maintain your account, process your transactions, and deliver the gaming services you have contracted for. Without this processing, phtaya1 cannot provide you with its services.
• Legal obligation: Processing required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (Republic Act No. 9160, as amended), PAGCOR regulatory requirements, and tax reporting obligations.
• Legitimate interest: Processing undertaken to pursue phtaya1's legitimate business interests, including fraud detection, platform security, responsible gaming monitoring, and improvement of platform performance — where these interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing undertaken on the basis of your freely given, specific, informed, and unambiguous consent — primarily in relation to direct marketing communications and the use of non-essential cookies. You may withdraw consent for these activities at any time without affecting the lawfulness of prior processing.

phtaya1 uses the personal data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with these stated uses without first notifying you and, where required, obtaining your consent.

• Account creation and management: To register your phtaya1 account, maintain accurate account records, authenticate your login sessions, and manage your preferences and settings.
• Identity and age verification: To verify that you are who you say you are and that you meet the minimum age requirement of 21 years, in compliance with PAGCOR's player protection guidelines and Philippine gaming regulations.
• Payment processing: To process your deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank, and to maintain accurate financial records associated with your account.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
• Regulatory and AML compliance: To fulfill phtaya1's obligations under Philippine anti-money laundering legislation, PAGCOR reporting requirements, and other applicable regulatory mandates.
• Responsible gaming monitoring: To monitor gaming activity patterns for indicators of problem gambling behavior and to administer the responsible gaming tools made available through your account dashboard.
• Customer support: To respond to your support requests, resolve disputes, investigate complaints, and maintain records of communications with you.
• Marketing and promotions (consent-based only): To send you information about promotions, bonuses, and new features on phtaya1 where you have opted in to receive such communications. You may opt out at any time.
• Platform improvement: To analyze aggregated, anonymized usage data for the purposes of improving platform performance, game offerings, and the overall user experience.

phtaya1 does not sell, rent, or trade your personal information. We share your personal data with third parties only in the limited circumstances described below, and only to the minimum extent necessary for each purpose.

• Payment processing partners: GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank receive transaction data necessary to execute your deposits and withdrawals. These providers are independently regulated financial institutions with their own privacy obligations under Philippine law.
• KYC and identity verification providers: Third-party providers engaged by phtaya1 to assist with the verification of identity documents and the screening of players against regulatory databases.
• Game software providers: Providers whose game titles are hosted on the phtaya1 platform may receive anonymized session data for game performance and audit purposes. They do not receive your personal identity data.
• Regulatory authorities: PAGCOR and other competent Philippine regulatory and law enforcement bodies, where disclosure is required by applicable law, court order, or legitimate regulatory demand.
• Anti-money laundering compliance: The Anti-Money Laundering Council (AMLC) of the Philippines, where reporting obligations arise under the Anti-Money Laundering Act.
• Service providers operating under contract: Technology, hosting, analytics, and support vendors engaged by phtaya1 to operate the platform, all of whom are contractually bound to process your data only on phtaya1's instructions and to maintain appropriate security standards.

phtaya1 uses cookies and similar technologies (including web beacons, local storage, and session tokens) to operate and improve the platform. The categories of cookies deployed are as follows:

• Strictly necessary cookies: Required to operate core platform functions, including authentication, session management, and security features. These cookies cannot be disabled without rendering the platform non-functional.
• Functional cookies: Used to remember your preferences, such as language settings and game lobby view configurations, to provide a more personalized experience.
• Analytics cookies: Used to collect anonymized data about how players interact with the platform — pages visited, session duration, and navigation patterns — to improve platform design and performance.
• Security and fraud-prevention cookies: Used to identify unusual or suspicious patterns of access and protect the integrity of player accounts.

You may configure your browser settings to refuse or delete non-essential cookies at any time. Please note that disabling cookies beyond the strictly necessary category may affect the functionality of certain platform features. phtaya1 does not deploy third-party advertising cookies that track your activity across other websites.

phtaya1 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

At the expiry of applicable retention periods, personal data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual. Where data is required to be retained beyond the standard period due to an ongoing legal dispute, regulatory investigation, or court order, it will be held only for as long as that requirement persists.

phtaya1 implements and maintains comprehensive technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phtaya1 platform.
• Encryption at rest for all personal and financial data stored on phtaya1's servers.
• Role-based access controls ensuring that personnel may access personal data only to the extent required by their specific operational function, governed by a formal data access policy.
• Two-factor authentication (2FA) available to all account holders and mandatory for phtaya1 internal administrative systems handling personal data.
• Continuous security monitoring for anomalous access patterns, unauthorized login attempts, and potential data breach indicators.
• Regular penetration testing and security audits conducted by qualified third-party security professionals.
• Incident response procedures aligned with the notification requirements of the Philippine Data Privacy Act, including mandatory breach notification to the National Privacy Commission within 72 hours of discovery where required.

The primary servers and data processing infrastructure used by phtaya1 are located within jurisdictions selected for their data protection standards and reliability. Where personal data is transferred to or processed in a jurisdiction outside the Philippines, phtaya1 implements appropriate safeguards to ensure that your data receives a comparable level of protection to that afforded by the Philippine Data Privacy Act.

Such safeguards include contractual data processing agreements with all third-party service providers and vendors that incorporate data protection obligations equivalent to those applicable under Philippine law. Where third-party game software providers process session data outside the Philippines, this is done on an anonymized basis that does not permit identification of individual players.

phtaya1 will not transfer personal data to any jurisdiction identified by the National Privacy Commission as providing inadequate data protection without first implementing such additional safeguards as the Commission may require.

Under the Philippine Data Privacy Act of 2012, you have the following legally enforceable rights in respect of your personal data held by phtaya1. These rights may be exercised at any time by contacting our Data Protection Officer using the details in Section 17.

phtaya1 will respond to all data rights requests within 15 calendar days of receipt where the request is straightforward, and within 30 calendar days for complex or multiple requests. We may request proof of identity before processing a data subject rights request to prevent unauthorized disclosure.

Please note that certain rights are subject to legal limitations. For example, phtaya1 may be unable to erase data that is required to be retained for AML compliance or regulatory audit purposes under Philippine law. Where such a limitation applies, we will inform you clearly and explain the basis for it.

phtaya1 may send you promotional communications about bonuses, new game launches, sporting events available for betting, and other platform features. These communications are sent only where you have provided consent during registration or subsequently opted in through your account settings.

You may withdraw your consent to receive marketing communications at any time through either of the following methods:

• Updating your communication preferences in your phtaya1 account settings
• Contacting our support team at [email protected] with a request to unsubscribe

Opt-out requests are processed within five (5) business days. Opting out of marketing communications does not affect phtaya1's ability to send you transactional and account-related communications — such as deposit confirmations, withdrawal notifications, KYC requests, and security alerts — which are necessary for the operation of your account and cannot be opted out of while your account remains active.

phtaya1 employs KYC verification to enforce the 21+ age requirement. If phtaya1 becomes aware that personal data has been collected from a minor, we will take immediate steps to delete such data and close the associated account. If you believe that phtaya1 may have inadvertently collected data from a minor, please contact us immediately at [email protected].

Parents and guardians who are concerned about potential underage access to online gaming platforms are encouraged to use parental control software and to review the responsible gaming resources available on our Responsible Gaming page.

The phtaya1 platform may contain references to or integrate with third-party services — including payment gateways such as GCash and PayMaya — that operate under their own privacy policies and data protection frameworks. When you interact with a third-party service accessed through phtaya1, you do so subject to that service provider's privacy policy, not this one.

phtaya1 is not responsible for the privacy practices of any third-party service provider whose products or services are accessed through our platform, and we encourage you to review the privacy policies of any third party before submitting personal information to them.

phtaya1 reviews and updates this Privacy Policy periodically to reflect changes in our data processing activities, applicable law, and regulatory guidance from the National Privacy Commission. The effective date at the top of this Policy indicates when it was last revised.

When material changes are made to this Privacy Policy, phtaya1 will notify registered players via email to the address on their account and/or through a notice displayed prominently on the platform. We encourage you to review this Policy whenever you receive such a notification.

Your continued use of the phtaya1 platform following notification of material changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you must cease using the platform and may contact support to arrange account closure.

For all matters relating to this Privacy Policy, including data subject rights requests, questions about how your data is handled, or concerns about phtaya1's data protection practices, please contact our Data Protection Officer using the details below. Do not hesitate to reach out — privacy inquiries are handled by dedicated personnel and are not routed through general customer service queues.

If you believe that phtaya1 has handled your personal data in a manner inconsistent with this Privacy Policy or the Philippine Data Privacy Act, and you are not satisfied with the resolution provided by our internal process, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph. phtaya1 will cooperate fully with any NPC investigation.