phmasaya Privacy Policy

1. Who We Are

1.1 phmasaya ("we," "us," "our," "the Company") operates the online gaming platform accessible at phmasaya.org and any associated mobile-optimised interfaces. phmasaya is the data controller responsible for your personal information collected through the platform.

1.2 This Privacy Policy applies to all personal data collected from registered Players, visitors to the phmasaya website, and individuals who interact with phmasaya through any of its communication channels, including customer support.

1.3 This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines.

2. Personal Data We Collect

2.1 phmasaya collects the following categories of personal data:

2.2 phmasaya does not collect sensitive personal information as defined under Republic Act No. 10173 (such as racial or ethnic origin, political opinions, or health data) unless specifically required for responsible gaming compliance purposes and with your explicit consent.

3. How We Collect Your Data

3.1 phmasaya collects personal data through the following methods:

• Direct provision: Information you provide when registering your phmasaya account, completing KYC verification, making deposits or withdrawals, or contacting our support team;
• Automated technologies: Technical data collected automatically when you access the phmasaya platform, including through cookies, session identifiers, and server logs;
• Payment processors: Transaction-related data received from GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other payment providers when you conduct financial transactions on phmasaya;
• Identity verification services: Data received from third-party KYC verification providers used to confirm the authenticity of identity documents submitted to phmasaya;
• Fraud prevention services: Risk assessment data from third-party anti-fraud and anti-money laundering (AML) screening services as required under Philippine law.

4. How phmasaya Uses Your Data

4.1 phmasaya processes your personal data for the following purposes:

• To create, maintain, and administer your phmasaya account;
• To verify your identity and age (21+) in accordance with KYC requirements;
• To process deposits, withdrawals, and other financial transactions on the platform;
• To provide customer support and respond to your queries and complaints;
• To detect and prevent fraud, money laundering, and other prohibited conduct;
• To comply with legal and regulatory obligations under Philippine law, including reporting obligations to the Anti-Money Laundering Council (AMLC) and PAGCOR;
• To administer bonuses, promotions, and loyalty rewards for which you have opted in;
• To send service-related notifications, including account security alerts and transaction confirmations;
• To improve the phmasaya platform, including game performance, interface design, and customer experience;
• To administer responsible gaming tools and monitor for signs of problem gambling behaviour;
• To send marketing communications about phmasaya promotions, where you have provided separate consent or where permitted by applicable law.

5. Legal Basis for Processing

5.1 phmasaya processes your personal data on the following legal grounds under the Philippine Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our obligations under the phmasaya Terms & Conditions, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with applicable Philippine law, including AMLC reporting, PAGCOR regulatory requirements, and tax obligations;
• Legitimate interests: Processing carried out for fraud prevention, platform security, and service improvement, where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and certain analytics activities, where your explicit consent has been obtained.

6. Sharing Your Personal Data

6.1 phmasaya does not sell your personal data to third parties. We may share your personal data with the following categories of recipients where necessary and lawful:

• Payment service providers: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and other payment processors to facilitate your transactions on phmasaya;
• KYC and identity verification providers: Third-party services that assist phmasaya in verifying the authenticity of identity documents;
• Fraud prevention and AML service providers: Third-party risk assessment platforms used to screen transactions and player activity for suspicious patterns;
• Game software providers: Platform operators and game studios whose titles are integrated into the phmasaya game lobby, where necessary for game provision and technical support;
• Regulatory authorities: The Anti-Money Laundering Council (AMLC), PAGCOR, the National Privacy Commission (NPC), and other Philippine government authorities, where disclosure is required by law;
• Legal and professional advisors: Law firms, auditors, and compliance consultants engaged by phmasaya, subject to appropriate confidentiality obligations;
• IT service providers: Cloud hosting, data storage, and cybersecurity service providers engaged by phmasaya to operate and secure the platform.

6.2 All third-party recipients are required to process your personal data only for the specified purpose and in accordance with phmasaya's instructions and applicable Philippine law.

7. International Data Transfers

7.1 Some of phmasaya's service providers may be located outside the Philippines. Where personal data is transferred internationally, phmasaya ensures that appropriate safeguards are in place as required under the Philippine Data Privacy Act of 2012 and NPC regulations, including contractual clauses that obligate the recipient to maintain an equivalent level of data protection.

7.2 phmasaya will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards.

8. Data Retention

8.1 phmasaya retains your personal data for as long as your phmasaya account remains active and for a period thereafter as required by applicable law.

8.2 Specific retention periods applicable to phmasaya data:

8.3 Upon expiry of the applicable retention period, phmasaya will securely delete or anonymise your personal data in accordance with its data disposal procedures.

9. Your Data Privacy Rights

9.1 As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmasaya:

• Right to be informed: The right to be notified that your personal data is being collected and processed, and of the purposes thereof;
• Right of access: The right to request a copy of the personal data phmasaya holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data in your phmasaya account;
• Right to erasure: The right to request deletion of your personal data, subject to phmasaya's legal retention obligations;
• Right to object: The right to object to the processing of your personal data on grounds of legitimate interest or for direct marketing purposes;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to damages: The right to be indemnified for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data.

9.2 To exercise any of these rights, submit a written request to phmasaya at [email protected] with the subject line "Data Privacy Request – [Your Account ID]." phmasaya will respond within fifteen (15) business days of receipt.

9.3 If you believe phmasaya has violated your data privacy rights, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

10. Cookies and Tracking Technologies

10.1 phmasaya uses cookies and similar tracking technologies to operate and improve the platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for core platform functionality including login session management and security. These cannot be disabled;
• Performance cookies: Used to analyse how players interact with phmasaya, including page load times and error reporting, to improve platform performance;
• Functional cookies: Used to remember your preferences, such as language settings and game display options;
• Analytics cookies: Used to understand aggregate player behaviour patterns on phmasaya to inform product development decisions.

10.2 You may control non-essential cookies through your browser settings. Disabling certain cookies may affect your experience of the phmasaya platform. Strictly necessary cookies cannot be disabled without impairing core functionality.

11. Children's Privacy

11.1 The phmasaya platform is strictly intended for persons aged 21 years and above. phmasaya does not knowingly collect personal data from individuals under the age of 21.

11.2 If phmasaya discovers that personal data has been collected from a person under 21, the account will be immediately suspended, all associated data will be deleted, and any deposits will be returned to the original payment method. Parents or guardians who believe a minor has registered on phmasaya should contact [email protected] immediately.

12. Security Measures

12.1 phmasaya implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phmasaya's servers;
• Encryption at rest for sensitive personal and financial data stored on phmasaya's infrastructure;
• Multi-factor authentication options for player accounts;
• Regular security audits and penetration testing conducted by independent cybersecurity professionals;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Incident response procedures for the detection and notification of data breaches in accordance with NPC requirements.

12.2 In the event of a personal data breach that poses a risk to your rights and freedoms, phmasaya will notify the NPC within 72 hours of becoming aware of the breach and will notify affected Players without undue delay.

13. Third-Party Links

13.1 The phmasaya platform may contain links to third-party websites or services. phmasaya is not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party platforms you access via links from phmasaya before providing any personal data.

14. Changes to This Privacy Policy

14.1 phmasaya may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered Players via the mobile number or email address associated with their phmasaya account at least seven (7) days before the revised policy takes effect.

14.2 The current version of the phmasaya Privacy Policy is always available at phmasaya.org/privacy-policy. The "Effective Date" at the top of the policy indicates when the current version came into force. Your continued use of the phmasaya platform after the effective date constitutes acceptance of the revised Privacy Policy.

15. Contact and Data Protection Officer

15.1 For all data privacy-related queries, requests, or complaints concerning phmasaya's handling of your personal data, please contact us:

15.2 If your complaint is not resolved to your satisfaction, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.