ph97 Privacy Policy

ph97 ("ph97", "we", "us", or "our") operates the online gaming platform accessible at ph97.win (the "ph97 Platform"). In the course of operating this platform and providing gaming services to Filipino players, ph97 collects and processes personal data relating to registered players and website visitors.

This Privacy Policy explains, in compliance with Republic Act 10173 (the "Data Privacy Act of 2012", or "DPA") and the implementing rules and regulations issued by the National Privacy Commission of the Philippines ("NPC"), what personal data ph97 collects, the lawful basis on which we process it, how we use and share it, how long we retain it, and what rights you have as a data subject.

ph97 is also subject to data handling requirements imposed by PAGCOR as part of its gaming licensing conditions. Where PAGCOR requirements differ from or supplement the DPA, ph97 will comply with the stricter of the two standards.

This Privacy Policy applies to all users of the ph97 Platform, including registered account holders and unregistered visitors who browse ph97.win without creating an account. If you do not agree with this Privacy Policy, you should not use the ph97 Platform.

ph97 is the data controller in respect of personal data collected through the ph97 Platform. As data controller, ph97 is responsible for determining the purposes and means by which your personal data is processed, and for ensuring that such processing complies with the Data Privacy Act of 2012 and applicable NPC regulations.

ph97 has designated a Data Protection Officer ("DPO") responsible for overseeing ph97's data protection compliance program. If you have questions, concerns, or requests relating to the personal data ph97 holds about you, you may contact the ph97 DPO through the contact details provided in Section 14 of this Privacy Policy.

ph97 has registered its data processing activities with the National Privacy Commission in accordance with the NPC's registration requirements for personal information controllers handling sensitive personal information.

ph97 collects the following categories of personal data, depending on your interaction with the ph97 Platform:

ph97 collects personal data through the following means:

• Directly from you: When you register a ph97 Account, complete KYC verification, make a deposit or withdrawal, contact support, or update your Account settings, you provide personal data to ph97 directly.
• Automatically through the Platform: When you access ph97.win, our systems automatically record technical data including your IP address, device information, session duration, pages visited, and game interactions. This data is collected through server logs, cookies, and similar technologies described in Section 7.
• From payment service providers: When you make a deposit using GCash, Maya, BPI, BDO, Metrobank, Coins.ph, 7-Eleven Cliqq, or USDT TRC20, the relevant payment provider shares transaction confirmation data with ph97 to credit your Account Balance. ph97 does not store full payment credentials (such as complete bank account numbers or full card numbers) on its own servers.
• From identity verification providers: Where ph97 uses a third-party KYC verification service to authenticate identity documents or selfie checks, that provider shares the verification outcome and associated identity data with ph97 for the purpose of completing your Account verification.
• From fraud and security tools: ph97 uses automated fraud detection and security monitoring tools that process technical and behavioural data to identify potentially suspicious activity on the Platform.

ph97 processes your personal data only for specified, explicit, and legitimate purposes. The following table sets out the primary purposes for which ph97 processes personal data and the lawful basis for each, as defined under the Data Privacy Act of 2012:

ph97 will not process your personal data for any purpose not listed above or otherwise disclosed to you at the time of collection, unless ph97 is required to do so by law, or unless ph97 has obtained your separate and specific consent for the new purpose.

ph97 does not sell, rent, or trade your personal data to any third party. ph97 shares personal data only in the following limited circumstances:

• Payment processors: ph97 shares the minimum necessary transaction data with payment service providers (including GCash, Maya, BPI, BDO, Metrobank, Coins.ph, and cryptocurrency processing partners) solely to process your deposit and withdrawal transactions.
• KYC and identity verification providers: ph97 engages certified third-party identity verification services to assist with document authentication and age verification. These providers process your identity data under data processing agreements that impose confidentiality and security obligations equivalent to those that apply to ph97.
• Game providers: The game software providers whose titles are hosted on the ph97 Platform may receive session-level technical data (e.g., session tokens, game stake and outcome data) necessary to operate game mechanics. Game providers do not receive your identity, contact, or financial data.
• Regulatory authorities: ph97 is required by law to share certain player data — including identity information, gaming records, and financial transaction histories — with PAGCOR and, where required, with the Anti-Money Laundering Council (AMLC) of the Philippines. Sharing with these authorities is a legal obligation and is not subject to your consent.
• Law enforcement and courts: ph97 will disclose personal data to law enforcement agencies, courts, or other government bodies in the Philippines where required to do so by a valid legal order, warrant, subpoena, or regulatory direction.
• Corporate transactions: In the event of a merger, acquisition, or transfer of assets involving ph97, your personal data may be transferred as part of that transaction, subject to the acquirer or successor entity agreeing to be bound by obligations equivalent to those set out in this Privacy Policy.

All third parties with whom ph97 shares personal data are required to implement appropriate technical and organisational security measures and to process that data only for the purpose for which it was shared.

ph97 uses cookies and similar tracking technologies when you access ph97.win. Cookies are small text files stored on your device that help the platform function correctly and allow ph97 to understand how the platform is used.

ph97 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the ph97 Platform to function. These include session authentication cookies that keep you logged into your ph97 Account during an active session, security cookies that help detect and prevent fraudulent activity, and load-balancing cookies that direct traffic to available servers. These cookies cannot be disabled without impairing the functionality of the ph97 Platform.
• Functional Cookies: These remember your preferences — such as your preferred game category or display settings — so that you do not have to re-configure them on each visit.
• Analytics Cookies: ph97 uses analytics tools to measure how players navigate and use the ph97 Platform. This data is used in aggregated, anonymised form to improve platform design and performance. Analytics cookies do not identify you as an individual.
• Marketing Cookies: Only set if you have opted in to receive promotional communications from ph97. These cookies allow ph97 to understand which promotions are most relevant to your gaming activity so that we can send you communications that are genuinely useful to you.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging into your ph97 Account and using the platform's core features.

ph97 retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for the period required by applicable law and regulatory requirements, whichever is longer.

The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your active ph97 Account and for a minimum of five (5) years following permanent Account closure, in compliance with PAGCOR record-keeping requirements and AML obligations under RA 9160.
• KYC documentation: Retained for at least five (5) years following Account closure or the date of the last transaction, whichever is later, as required by the Anti-Money Laundering Act.
• Financial transaction records: Retained for at least five (5) years from the date of each transaction, in line with BSP and AMLC record-keeping rules.
• Gaming records: Retained for at least two (2) years from the date of each session, or longer where records are relevant to an open dispute or regulatory inquiry.
• Support and correspondence records: Retained for two (2) years from the date of the last interaction, unless the records are relevant to an unresolved dispute or legal proceeding.
• Technical and log data: Typically retained for a rolling period of 12 months, except where specific records are flagged for extended retention due to security investigations or regulatory requirements.

When personal data is no longer required for any of the above purposes, ph97 securely deletes or permanently anonymises it. Anonymised data — which can no longer be linked back to an individual — may be retained indefinitely for aggregate analytics purposes.

ph97 implements a comprehensive set of technical and organisational security measures designed to protect your personal data from unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data transmitted between your device and the ph97 Platform is protected using 256-bit TLS/SSL encryption. This applies to account login, payment transactions, game sessions, and all other platform interactions.
• Encryption at rest: Sensitive personal and financial data stored on ph97 servers is encrypted using industry-standard symmetric encryption algorithms.
• Access controls: Access to systems that process personal data is restricted to ph97 staff who have a business need to access that data. Access is governed by role-based permissions, and all access to sensitive data is logged and audited.
• Pseudonymisation: Where feasible, ph97 stores personal data in a pseudonymised form — meaning that data that could directly identify you is held separately from operational data, and the two sets can only be linked using a separately secured key.
• Security monitoring: ph97 operates continuous security monitoring of its platform infrastructure to detect and respond to potential intrusions, anomalous access patterns, and other security threats.
• Vulnerability management: ph97 conducts periodic security assessments of its platform infrastructure and application code, and applies security patches and updates on a risk-prioritised basis.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, ph97 will notify the NPC and, where required, affected players within the timeframes required by NPC Circular 16-03 and applicable DPA implementing rules.

Under the Data Privacy Act of 2012 and NPC regulations, you have the following rights in respect of your personal data held by ph97:

To exercise any of the above rights, contact ph97 via the 24/7 live chat on ph97.win or by email at [email protected], specifying the right you wish to exercise and providing sufficient information to verify your identity. ph97 will respond within fifteen (15) business days of receipt of a verified request. Some rights are subject to exceptions where ph97 has overriding legal obligations — for example, the right to erasure is subject to PAGCOR and AML retention requirements.

If ph97 discovers, through its KYC processes or any other means, that personal data has been collected from a person under the age of 21, ph97 will immediately close the relevant Account, securely delete the personal data collected, return any deposited funds to the payment source, and where legally required, notify the appropriate regulatory authority.

Parents and guardians who believe that a minor in their care has registered a ph97 Account or provided personal data to ph97 are encouraged to contact ph97 support immediately via live chat on ph97.win so that appropriate action can be taken without delay.

ph97 will only send you promotional communications — including offers, bonuses, new game announcements, and tournaments — if you have specifically opted in to receive such communications during Account registration or subsequently through your Account preferences.

You may withdraw your marketing consent at any time by: (a) updating your notification preferences in your ph97 Account settings; or (b) contacting ph97 support via live chat or email at [email protected] and requesting removal from marketing communications. Opt-out requests are processed within five (5) business days.

Withdrawing marketing consent does not affect transactional communications — ph97 will continue to send you account-related alerts (such as OTP codes, deposit confirmations, withdrawal notifications, and security alerts) which are necessary for the operation of your Account and cannot be opted out of while your Account remains active.

ph97 does not sell or share your contact details with third-party marketers. All promotional communications you receive from ph97 are sent by ph97 directly using your registered mobile number or email address.

ph97 may update this Privacy Policy from time to time to reflect changes in applicable law, NPC or PAGCOR guidance, our data processing activities, or the technology we use to operate the ph97 Platform.

Where changes are material — meaning they significantly affect your privacy rights or the way ph97 processes your personal data — ph97 will notify registered Players via their registered mobile number or email address at least fourteen (14) days before the updated Privacy Policy takes effect.

The date of the most recent update to this Privacy Policy is displayed at the top of this page. Your continued use of the ph97 Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised policy. If you do not agree with the changes, you should close your Account and request deletion of your personal data before the effective date.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how ph97 has handled your personal data, please contact ph97 using the following channels:

• Live Chat: 24/7 live chat support available on ph97.win — the fastest way to reach the ph97 team for account and data-related queries.
• Email: [email protected] — for written requests regarding data subject rights and formal complaints.

ph97 will acknowledge data-related requests within two (2) business days and will aim to resolve complaints within fifteen (15) business days. For complex requests, ph97 may require up to thirty (30) business days and will notify you if an extension is required.

If you are not satisfied with ph97's response to your complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC). The NPC's complaint procedure and contact details are available on the official NPC website. ph97 will cooperate fully with any NPC investigation.