phmaco Privacy Policy

1. Who We Are

phmaco ("phmaco," "we," "us," or "our") operates the online gaming platform accessible at phmaco.app, providing casino games, sports betting, bingo, e-sports wagering, and related entertainment services to players in the Philippines.

phmaco acts as the data controller in respect of the personal information collected through the phmaco platform. As data controller, phmaco determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with the Philippine Data Privacy Act of 2012 (RA 10173) and all applicable regulations issued by the National Privacy Commission.

This Privacy Policy applies to all personal data collected through the phmaco website, mobile interface, customer support channels, and any other touchpoint through which you interact with phmaco.

2. Personal Data We Collect

phmaco collects personal data from you in the following categories, depending on how you interact with our platform:

Registration and Identity Data:

• Full legal name, date of birth, and gender
• Residential address (including city — Manila, Cebu, Davao, Quezon City, Makati, or elsewhere in the Philippines)
• Email address and Philippine mobile number
• Government-issued identification document details (e.g., Philippine passport number, SSS ID, PhilSys National ID, driver's license, or UMID)
• Selfie photographs submitted for identity verification purposes

Financial and Payment Data:

• GCash account details, PayMaya account details, or bank account information (BPI, BDO, Metrobank) used for deposits and withdrawals
• Transaction history, including deposit amounts, withdrawal amounts, and dates
• Source of funds documentation where required for AML compliance

Gaming Activity Data:

• Game history, bet amounts, win/loss records, and session durations
• Bonus usage, wagering activity, and loyalty program participation
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status)

Technical and Device Data:

• IP address, device type, operating system, and browser type
• Geolocation data (country and region level) to verify eligibility
• Cookie identifiers and session tokens
• Platform interaction logs, including login timestamps and navigation patterns

Communications Data:

• Records of your communications with phmaco customer support via live chat or email
• Survey responses and feedback submitted through the platform

3. How We Use Your Personal Data

phmaco uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your phmaco account, including processing your registration, verifying your identity, and managing your account settings.
• Payment Processing: To process deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods, and to maintain accurate financial records.
• Regulatory Compliance: To comply with our obligations under Philippine law, including anti-money laundering (AML) requirements, PAGCOR regulatory directives, and the Data Privacy Act of 2012.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and other security threats to the phmaco platform and its players.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling, enforce deposit limits and self-exclusion requests, and proactively reach out to players who may need support.
• Customer Support: To respond to your inquiries, resolve disputes, and provide assistance through our 24/7 live chat and email support channels.
• Platform Improvement: To analyze usage patterns, identify technical issues, and improve the performance, features, and user experience of the phmaco platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications.

4. Legal Basis for Processing

phmaco processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing required to perform our obligations under the phmaco Terms & Conditions, including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable Philippine laws and regulations, including AML obligations, PAGCOR requirements, and tax reporting duties.
• Legitimate Interests: Processing necessary for phmaco's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, and informed consent, including the sending of marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Sharing Your Personal Data

phmaco does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, solely to process your deposits and withdrawals.
• Game Providers: Licensed game content providers whose games are available on the phmaco platform, to the extent necessary to deliver game services and maintain game integrity.
• Identity Verification Services: Third-party KYC and AML compliance service providers engaged to assist with identity verification and fraud prevention.
• Regulatory Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other Philippine government authorities where disclosure is required by law or regulatory directive.
• IT and Infrastructure Providers: Cloud hosting, data storage, and cybersecurity service providers engaged to support the operation and security of the phmaco platform.
• Professional Advisors: Legal counsel, auditors, and other professional advisors engaged by phmaco in connection with legal proceedings, compliance reviews, or corporate transactions.

All third parties with whom phmaco shares personal data are required to process such data in accordance with applicable Philippine data protection law and are prohibited from using it for any purpose other than the specific purpose for which it was shared.

6. Data Retention

phmaco retains your personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and Identity Data: Retained for the duration of your phmaco account and for a minimum of five (5) years following account closure, in compliance with Philippine AML regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act of 2001 (RA 9160, as amended).
• Gaming Activity Data: Retained for the duration of your account and for three (3) years following account closure.
• Customer Support Communications: Retained for two (2) years from the date of the communication.
• Marketing Consent Records: Retained for the duration of your consent and for one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, phmaco will securely delete or anonymize your personal data in accordance with our data disposal procedures.

7. Security Measures

phmaco implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• TLS encryption for all data transmitted between your device and the phmaco platform
• AES-256 encryption for sensitive data stored in phmaco databases
• Multi-factor authentication options for player account access
• Role-based access controls limiting employee access to personal data on a need-to-know basis
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• 24/7 security monitoring and intrusion detection systems
• Secure data backup procedures with encrypted off-site storage
• Staff training on data protection and information security best practices

While phmaco takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phmaco will notify the National Privacy Commission and affected players in accordance with the requirements of the Data Privacy Act of 2012.

8. Cookies and Tracking Technologies

phmaco uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored on your device that help us recognize you, remember your preferences, and analyze how the platform is used.

phmaco uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function correctly. These include session cookies that keep you logged in and security cookies that protect against fraudulent activity. These cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players navigate and use the phmaco platform, helping us identify areas for improvement.
• Marketing Cookies: Used to deliver relevant promotional content to players who have opted in to receive marketing communications from phmaco.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of the phmaco platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

9. Your Data Protection Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by phmaco:

• Right to Be Informed: The right to be informed about how your personal data is collected, used, and processed — which this Privacy Policy fulfills.
• Right of Access: The right to request a copy of the personal data phmaco holds about you, along with information about how it is being processed.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact phmaco's Data Protection Officer at [email protected]. We will respond to all verified requests within fifteen (15) business days. If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

10. Children's Privacy

The phmaco platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. phmaco does not knowingly collect personal data from individuals under the age of 21.

If phmaco becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete the personal data in question, and report the matter to the relevant Philippine authorities where required by law.

If you are a parent or guardian and believe that your child has registered on the phmaco platform, please contact us immediately at [email protected] so that we can take appropriate action without delay.

11. Changes to This Privacy Policy

phmaco reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or regulatory requirements. When we make material changes to this policy, we will notify registered players via email or through a prominent notice on the phmaco platform prior to the changes taking effect.

The date at the top of this Privacy Policy indicates when it was last reviewed and updated. We encourage you to review this policy periodically to stay informed about how phmaco protects your personal data. Your continued use of the phmaco platform following notification of changes constitutes your acknowledgment of the revised Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or phmaco's data processing practices, please contact our Data Protection Officer through the following channel:

• Email: [email protected]
• Live Chat: Available 24/7 through the in-app chat feature on the phmaco platform

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data protection rights have been violated.