1 Introduction
This Privacy Policy ("Policy") describes how phtaya8 ("we", "us", "our", "the Platform") collects, uses, processes, stores, and protects personal data about individuals ("you", "Player", "User") who access or use the phtaya8 website, mobile platform, games, and all related services available at phtaya8.net.
phtaya8 is fully committed to respecting your privacy and protecting your personal data in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) as enforced by the National Privacy Commission (NPC) of the Philippines.
This Policy applies to all personal data collected by phtaya8 through any channel — including our website, mobile app, customer support communications, payment transactions, and third-party game integrations. By registering an account or using the phtaya8 platform, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.
Scope Note: This Policy covers personal data collected from registered players, prospective players who browse the phtaya8 platform, and individuals who contact us through support channels. It does not govern the privacy practices of third-party game providers or payment processors, who maintain their own privacy policies governing the data they independently hold.
2 Who We Are
phtaya8 is a PAGCOR-regulated online casino and sports betting platform built specifically for Filipino players. We operate under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR), the government body responsible for regulating lawful gambling activity in the Republic of the Philippines.
As a personal information controller (PIC) under the Data Privacy Act of 2012, phtaya8 determines the purposes and means by which personal data collected on the platform is processed. We have appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the DPA and serving as the primary point of contact for data privacy matters.
Data Protection Officer: For all privacy-related inquiries, requests, and complaints, you may contact our DPO directly at
[email protected] with the subject line "Data Privacy Request – [Your Concern]". Our DPO team responds to all privacy inquiries within five (5) business days.
Our registered operations are conducted under PAGCOR's regulatory framework for internet gaming, and all data processing activities are subject to PAGCOR's oversight in addition to the NPC's jurisdiction under the DPA.
3 Data We Collect
phtaya8 collects personal data that is necessary for the operation of a licensed online gambling platform in the Philippines. The categories of personal data we collect are set out in the table below, along with the circumstances in which each category is collected.
| Data Category |
Specific Data Points |
When Collected |
| Identity Data |
Full legal name, date of birth, gender, nationality, government ID type and number (e.g., PhilSys, passport, driver's license, UMID) |
Account registration and KYC verification |
| Contact Data |
Mobile number, email address, home address (city, province, region) |
Account registration and profile updates |
| Financial Data |
GCash number, PayMaya account, bank account details (BPI, BDO, Metrobank), transaction history, deposit and withdrawal records |
Deposit/withdrawal processing and KYC |
| Verification Data |
Copies of government-issued IDs, selfie with ID, proof of payment method, utility bills (for address verification) |
KYC and enhanced due diligence |
| Technical Data |
IP address, device type, browser type and version, operating system, session timestamps, login history |
Automatic collection on platform access |
| Usage Data |
Games played, bet amounts, win/loss records, session duration, bonus usage, responsible gaming tool interactions |
During active game sessions |
| Communications Data |
Live chat transcripts, support email correspondence, feedback submissions |
When you contact support or submit feedback |
| Marketing Preferences |
Promotional opt-in/opt-out status, notification preferences, preferred game categories |
Account settings and promotional sign-ups |
Sensitive Personal Information: Government-issued ID numbers, financial account details, and identity verification documents are classified as sensitive personal information under the DPA. phtaya8 applies additional safeguards to this category of data, including restricted access controls and enhanced encryption at rest and in transit.
phtaya8 does not collect special categories of personal data — such as biometric data, health data, or political affiliations — unless explicitly required by PAGCOR regulations or law enforcement directives, in which case the collection will be separately disclosed to you.
4 How We Use Your Data
phtaya8 uses the personal data we collect strictly for the purposes outlined below. We do not process your data for any purpose beyond what is described in this Policy unless we obtain your explicit consent or are required to do so by law.
- Account Creation and Management: To register your phtaya8 account, verify your identity and age (21+ requirement), manage your account profile, and provide you with access to all platform features.
- KYC and Anti-Money Laundering (AML) Compliance: To fulfill our mandatory obligations under PAGCOR's KYC and AML framework, which requires us to verify player identity and monitor transactions for signs of money laundering or terrorist financing activity.
- Payment Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank; to verify ownership of payment methods; and to maintain accurate financial records as required by Philippine law.
- Game Provision and Platform Operation: To deliver our game library — including slots, live dealer tables, bingo, sabong, sports betting, EVO Live, and Queen of Bounty — and to ensure a smooth, fair, and personalized gaming experience.
- Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account compromise, collusion, bonus abuse, and other prohibited conduct that violates our Terms & Conditions.
- Responsible Gaming: To monitor account activity for indicators of problem gambling and to administer responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion, in compliance with PAGCOR's responsible gaming standards.
- Customer Support: To respond to your support inquiries, resolve disputes, process complaints, and provide assistance with technical and account-related issues.
- Regulatory Reporting: To fulfill mandatory reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities where required by law.
- Marketing and Promotions (with consent): To send you promotional offers, bonus notifications, and event updates — but only if you have opted in to receive marketing communications. You may withdraw this consent at any time through your account settings.
- Platform Improvement: To analyze aggregated usage data and improve our website performance, game selection, user experience, and customer support quality. This analysis uses anonymized or pseudonymized data wherever possible.
phtaya8 applies the principle of data minimization — we collect and process only the personal data that is genuinely necessary for each of the above purposes. We do not collect data "just in case" it might be useful in the future.
5 Legal Basis for Processing
Under the Data Privacy Act of 2012, phtaya8 must have a lawful basis for each type of personal data processing we carry out. The following legal bases apply to our data processing activities:
- Contractual Necessity: Processing your identity, contact, and financial data is necessary to perform the contract between you and phtaya8 — specifically, to provide you with the gaming services, process your transactions, and manage your account as described in our Terms & Conditions.
- Legal Obligation: Processing for KYC verification, AML monitoring, PAGCOR regulatory reporting, and tax compliance is required by Philippine law and PAGCOR regulations. phtaya8 has no discretion to decline this processing.
- Legitimate Interest: Processing for fraud prevention, platform security, and responsible gaming monitoring is based on phtaya8's legitimate interest in maintaining a safe, secure, and fair gaming environment for all players, provided that this interest is not overridden by your privacy rights.
- Consent: Processing for direct marketing communications and non-essential cookies is based on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
Withdrawing Consent: Where we rely on your consent as the legal basis for processing, you can withdraw it at any time by adjusting your notification preferences in your account dashboard, or by contacting our support team at
[email protected]. Withdrawing consent for marketing communications does not affect your ability to use the phtaya8 platform.
6 Data Sharing & Disclosure
phtaya8 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your data only in the limited circumstances described below, and only to the extent necessary for the specific purpose:
- PAGCOR and Regulatory Authorities: We are required by our operating license to share player identity, transaction, and account data with PAGCOR upon request, and to submit mandatory reports to the Anti-Money Laundering Council (AMLC) where required under the Anti-Money Laundering Act (AMLA).
- Licensed Game Providers: To deliver games from providers such as Evolution Gaming, Pragmatic Play, PG Soft, and Hacksaw Gaming, limited technical and session data (e.g., player session token, currency, game preferences) is shared with these providers solely to enable game delivery. These providers are contractually prohibited from using this data for their own independent purposes.
- Payment Service Providers: Financial data necessary to process your GCash, PayMaya, BPI, BDO, or Metrobank transactions is shared with the relevant payment service provider. These providers process your payment data under their own terms and applicable Bangko Sentral ng Pilipinas (BSP) regulations.
- Identity Verification Services: To perform automated KYC checks, your identity documents and associated data may be processed by a contracted third-party KYC verification provider. These providers act as personal information processors (PIPs) under a data processing agreement with phtaya8.
- Law Enforcement and Courts: Where required by a valid court order, subpoena, search warrant, or lawful directive from a Philippine law enforcement agency, phtaya8 will disclose personal data as legally required. We will notify affected players of such disclosure where permitted by law.
- Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of phtaya8's assets, player data may be transferred to the acquiring entity. You will be notified of any such transfer and any material changes to data processing practices before they take effect.
No Sale of Personal Data: phtaya8 strictly prohibits the sale or commercial licensing of player personal data to any third party for advertising, profiling, or any other commercial purpose. Any such activity would constitute a direct violation of the Data Privacy Act of 2012 and our own internal data governance policies.
7 Cookies & Tracking
The phtaya8 platform uses cookies and similar tracking technologies to operate the website, remember your preferences, analyze platform usage, and — with your consent — deliver relevant promotional content. A cookie is a small text file placed on your device by our server when you visit phtaya8.net.
The types of cookies used on phtaya8 are as follows:
- Strictly Necessary Cookies: Required for the website to function. These cookies manage your login session, maintain your game session state, and enable secure platform access. They cannot be disabled without breaking core platform functionality. No consent is required for these cookies.
- Functional Cookies: Used to remember your preferences such as language setting, display options, and responsible gaming tool configurations. These enhance your experience but are not essential for core functionality.
- Analytics Cookies: Used to collect anonymized information about how visitors use phtaya8.net — including pages visited, session duration, and navigation paths — to help us improve platform performance and user experience. These require your consent.
- Marketing Cookies (Consent Required): Used to track the effectiveness of promotional campaigns and, with your consent, to deliver relevant bonus offers and game recommendations. These cookies are only activated if you opt in to marketing communications.
You can manage your cookie preferences at any time through your browser settings. Most browsers allow you to view, block, or delete cookies. Note that disabling certain cookies may affect the functionality of the phtaya8 platform. For instructions on managing cookies in your specific browser, refer to your browser's help documentation.
Mobile App Tracking: If you access phtaya8 through a mobile browser or dedicated app, similar tracking technologies — including device identifiers and mobile analytics SDKs — may be used. These are disclosed separately in the app's permissions documentation available on the download page.
8 Data Retention
phtaya8 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply to the main categories of player data we hold:
| Data Category |
Retention Period |
Basis |
| Identity & KYC Documents |
5 years after account closure |
PAGCOR licensing requirements; AMLA compliance |
| Financial Transaction Records |
5 years after the date of transaction |
Anti-Money Laundering Act; BIR record-keeping rules |
| Account Activity & Game Logs |
3 years after account closure |
PAGCOR audit requirements; dispute resolution |
| Customer Support Communications |
2 years after resolution of the relevant matter |
Legitimate interest in dispute management |
| Marketing Preferences |
Until consent is withdrawn, then deleted within 30 days |
Consent-based processing |
| Technical & Access Logs |
12 months from the date of collection |
Platform security and fraud detection |
| Self-Exclusion Records |
Indefinitely (or for the duration of the exclusion period, minimum 5 years) |
Responsible gaming obligations; PAGCOR requirements |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures. Data that has been anonymized beyond re-identification may be retained indefinitely for statistical analysis and platform improvement purposes.
9 Data Security
phtaya8 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction. Our security framework is aligned with the NPC's data security guidelines and PAGCOR's technical requirements for licensed online gaming operators.
- Encryption in Transit: All data transmitted between your device and phtaya8's servers is encrypted using TLS 1.2 or higher. This protects your login credentials, personal data, and financial information from interception during transmission.
- Encryption at Rest: Sensitive personal data — including government ID details, financial account information, and KYC documents — is encrypted at rest using industry-standard AES-256 encryption.
- Access Controls: Access to player personal data within phtaya8 is restricted on a need-to-know basis. Staff access is governed by role-based access controls (RBAC), and all access to sensitive data is logged and audited.
- Multi-Factor Authentication: Administrative access to systems containing player data requires multi-factor authentication (MFA). Players are also encouraged to enable MFA on their own phtaya8 accounts for additional security.
- Penetration Testing: phtaya8 conducts regular third-party penetration testing and vulnerability assessments of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.
- Incident Response: In the event of a personal data breach that is likely to pose a risk to your rights and freedoms, phtaya8 will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with NPC Circular No. 16-03.
Your Responsibility: While phtaya8 maintains robust technical security measures, you also play a role in protecting your account. Use a strong, unique password for your phtaya8 account, never share your login credentials or OTP codes with anyone — including anyone claiming to be phtaya8 staff — and contact support immediately if you suspect your account has been compromised.
10 Your Rights
Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phtaya8. These rights can be exercised by contacting our Data Protection Officer at [email protected].
🔍
Right to Access
Request a copy of the personal data we hold about you and information about how it is being processed.
✏️
Right to Rectification
Request correction of inaccurate or incomplete personal data we hold about you.
🗑️
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.
🚫
Right to Object
Object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interest.
📦
Right to Data Portability
Receive a copy of your personal data in a structured, machine-readable format for transfer to another service provider.
⏸️
Right to Restriction
Request that we restrict processing of your data in certain circumstances, such as while a dispute about accuracy is being resolved.
🔕
Right to Withdraw Consent
Withdraw consent for marketing communications or non-essential cookies at any time without affecting prior processing.
⚖️
Right to Lodge a Complaint
File a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.
phtaya8 will respond to all data subject rights requests within fifteen (15) business days of receipt. In complex cases, we may extend this period by a further ten (10) business days, in which case we will notify you of the extension and the reason for it.
Identity Verification for Rights Requests: To protect your privacy, we may ask you to verify your identity before we can process a rights request. This ensures that your data is not disclosed to or amended by an unauthorized person claiming to act on your behalf.
11 Children's Privacy
The phtaya8 platform is strictly restricted to individuals aged 21 years and above, as required by PAGCOR regulations governing casino-style online gambling in the Philippines. phtaya8 does not knowingly collect, process, or retain personal data from individuals under the age of 21.
Age verification is enforced at account registration through our mandatory KYC process, which requires submission of a valid government-issued Philippine ID. Any account where the holder is found to be under 21 years of age will be immediately and permanently closed, and all data associated with that account will be purged from our systems within 30 days of the determination, except where retention is required by law for AML reporting purposes.
Underage Access: If you are a parent or guardian and believe that a minor under your care has accessed or registered on the phtaya8 platform, please contact us immediately at
[email protected]. We will investigate and take immediate action, including account closure and data deletion, in accordance with our zero-tolerance policy on underage gambling.
12 Cross-Border Data Transfers
As a Philippine-based platform with international game provider partnerships, some of your personal data may be transferred to and processed in countries outside
the Philippines. This occurs primarily in connection with third-party game providers and technology infrastructure partners whose servers may be located in other jurisdictions.
Whenever we transfer personal data outside the Philippines, phtaya8 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under the Data Privacy Act of 2012. These safeguards include:
- Data Processing Agreements (DPAs): All third-party recipients of Philippine player data are required to sign a data processing agreement that contractually obligates them to process data only for specified purposes, maintain appropriate security measures, and comply with the DPA's cross-border transfer requirements.
- Adequacy Assessments: Before transferring data to a new jurisdiction or partner, phtaya8 conducts a transfer impact assessment to evaluate the data protection laws of the destination country and the recipient's security practices.
- Standard Contractual Clauses: Where no adequacy finding exists for the destination country, we rely on NPC-approved standard contractual clauses or equivalent binding corporate rules to provide a legal basis for the transfer.
- Minimization on Transfer: Only the minimum personal data necessary for the specific international processing purpose is transferred cross-border. Bulk transfers of full player datasets to overseas entities are prohibited under our internal data governance policy.
NPC Registration: As required by the Data Privacy Act and NPC regulations, phtaya8's data processing systems and cross-border transfer arrangements are registered with the National Privacy Commission. Players may contact our DPO at
[email protected] for more information about specific cross-border transfer safeguards.
13 Changes to This Policy
phtaya8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine laws and PAGCOR regulations, NPC guidance, or the introduction of new platform features that affect how personal data is handled.
When we make material changes to this Policy, we will notify registered players through one or more of the following channels:
- A prominent notice displayed on the phtaya8 homepage and within the player account dashboard upon next login.
- A direct notification sent to your registered email address at least fourteen (14) days before the updated Policy takes effect.
- An in-app push notification (if you have enabled notifications on the phtaya8 mobile platform).
The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the phtaya8 platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with material changes to this Policy, you have the right to close your account and request deletion of your personal data in accordance with Section 10 of this Policy.
Policy Archive: Previous versions of the phtaya8 Privacy Policy are retained internally and are available upon request by contacting our Data Protection Officer. This ensures full transparency about the history of our data processing practices.
14 Contact & DPO
If you have any questions, concerns, or requests related to this Privacy Policy or the way phtaya8 processes your personal data, you are welcome to get in touch with our Data Protection Officer. We take all privacy inquiries seriously and aim to provide clear, helpful responses within the timeframes set out in this Policy.
- Data Protection Officer: phtaya8 Privacy Team
- Email: [email protected] (subject line: "Data Privacy Request")
- Support Hours: Daily, 8:00 AM – 12:00 AM Philippine Standard Time (PST)
- Live Chat: Available on phtaya8.net during support hours
- Response Time: Within 5 business days for general privacy inquiries; within 15 business days for formal data subject rights requests
If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent authority responsible for administering and enforcing the Data Privacy Act of 2012. The NPC accepts complaints through its official website and processes them in accordance with NPC Circular No. 16-04 on the Rules on Complaints.
PAGCOR Concerns: For concerns related specifically to our licensed operations — including disputes about game fairness, responsible gaming measures, or regulatory compliance — you may also raise these with the Philippine Amusement and Gaming Corporation (PAGCOR), the regulatory body that oversees our operating license.