ph354 Privacy Policy

§1 Scope & Application

This Privacy Policy applies to all personal data collected, processed, stored, and shared by ph354 in connection with the operation of ph354.org and all associated services, including account registration, gameplay, payment processing, customer support, and marketing communications. It applies to all current and former players, visitors who browse ph354.org without registering, and individuals who contact ph354 via any support channel.

This Policy is intended to comply with the Data Privacy Act of 2012 of the Republic of the Philippines (Republic Act No. 10173) and its implementing rules and regulations, as well as applicable PAGCOR data governance requirements. Where international data protection standards impose higher obligations on ph354, those higher obligations shall apply.

§2 Data Controller

For the purposes of the Data Privacy Act of 2012, ph354 (operating at ph354.org) is the personal information controller responsible for the personal data of players and visitors processed in connection with the ph354 platform.

ph354 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data privacy legislation. The DPO may be contacted via the email address specified in Section 15 of this Policy with the subject line "Attention: Data Protection Officer."

§3 Categories of Personal Data We Collect

ph354 collects the following categories of personal data from players and visitors, depending on how you interact with the Platform:

3.1 Registration Data

• Full legal name as it appears on your government-issued Philippine identification document
• Date of birth (for age verification — players must be 21 years of age or older)
• Email address (used for account communication, password resets, and promotional communications where opted in)
• Philippine mobile number (used for OTP verification and account security)
• Username and password (password is stored in encrypted form only — ph354 never stores passwords in plain text)
• Residential address (required for KYC verification at the withdrawal stage)

3.2 Identity Verification (KYC) Data

• Scanned or photographed copies of government-issued Philippine identification documents (PSA National ID, UMID, passport, driver's licence, etc.)
• Proof of address documents (utility bills, bank statements dated within three months)
• Proof of payment method ownership (GCash account screenshot showing registered name, BPI or BDO account details)
• Source-of-funds documentation for withdrawals above applicable regulatory thresholds

3.3 Financial & Transaction Data

• Deposit and withdrawal history, including amounts, timestamps, and payment method references
• GCash, Maya, BPI, BDO, Metrobank, or USDT wallet/account references (not full account numbers — only the reference identifiers necessary to process transactions)
• Bonus and promotional credit history

3.4 Gameplay & Platform Activity Data

• Game session logs, bet amounts, game outcomes, and win/loss records
• Time and duration of platform sessions
• Game category preferences and browsing behaviour within the platform

3.5 Technical & Device Data

• IP address and approximate geographic location derived from IP data
• Device type, operating system, and browser information
• Cookie identifiers and session tokens (see Section 8)

3.6 Communications Data

• Records of live chat and email support interactions
• Content of communications you initiate with ph354 support staff
• Feedback and survey responses where provided voluntarily

§4 How We Collect Personal Data

ph354 collects personal data through the following channels:

• Directly from you: At account registration, during the KYC verification process, when you contact ph354 support, and when you submit any form or request on ph354.org.
• Through your use of the platform: Automatically through server logs, gameplay systems, and platform analytics tools when you browse or interact with ph354.org.
• From payment processors: Transaction references and payment confirmation data received from GCash, Maya, BPI, BDO, Metrobank, and USDT payment gateways when you deposit or withdraw funds.
• From KYC verification providers: Results of identity verification checks conducted by ph354's third-party KYC service provider on the documents you submit.
• From cookies and tracking technologies: Session cookies, functional cookies, and analytics technologies as described in Section 8 of this Policy.
• From publicly available sources: In limited circumstances for fraud prevention or KYC purposes, ph354 may verify information against publicly available Philippine government databases.

§5 Legal Basis for Processing

ph354 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to enter into and perform the contract between you and ph354 — including account creation, KYC verification, payment processing, game delivery, and withdrawal processing.
• Legal obligation: Processing required to comply with applicable Philippine law, PAGCOR regulations, anti-money laundering obligations (as required by Republic Act No. 9160 as amended), and tax reporting requirements.
• Legitimate interests: Processing carried out for ph354's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for direct marketing communications where you have opted in to receive promotional emails, SMS, or push notifications from ph354. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

§6 How ph354 Uses Your Personal Data

ph354 uses the personal data collected from players and visitors for the following purposes:

• Creating and maintaining your ph354 account, including verifying your identity and eligibility (21+ age requirement)
• Processing deposits, withdrawals, and bonus credits via GCash, Maya, BPI, BDO, Metrobank, and USDT
• Delivering all platform services including live casino, e-sabong, sports betting, slots, and bingo
• Verifying your identity and source of funds as required by KYC and anti-money laundering obligations
• Detecting, investigating, and preventing fraud, money laundering, cheating, bonus abuse, and other prohibited conduct
• Monitoring gameplay for responsible gaming purposes, including identifying patterns consistent with problem gambling and applying deposit limits or self-exclusions where appropriate
• Responding to your support requests via live chat and email
• Sending transactional communications — account confirmations, deposit receipts, withdrawal notifications, and security alerts
• Sending promotional and marketing communications where you have opted in to receive them
• Complying with PAGCOR record-keeping requirements and applicable Philippine law
• Conducting aggregate, anonymised analytics to improve platform performance and user experience

§7 Data Sharing & Third-Party Disclosure

ph354 does not sell, rent, or trade your personal data to third-party marketers. Your data may be shared with the following categories of recipients only to the extent necessary for the purposes described in Section 6:

• Payment processors: GCash (GXI/Mynt), Maya (Voyager Innovations), BPI, BDO, Metrobank, and USDT gateway providers receive transaction reference data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to Bangko Sentral ng Pilipinas (BSP) regulatory oversight.
• Game providers: Third-party game providers (including Pragmatic Play and others) may receive your account identifier and session token to deliver game content. Game providers are contractually prohibited from using this data for any purpose other than game delivery.
• KYC verification services: ph354's third-party identity verification provider receives copies of your identity documents and processes them for age and identity verification purposes. This provider is bound by data processing agreements consistent with the Data Privacy Act of 2012.
• Fraud prevention and analytics: Anonymised or pseudonymised data may be shared with fraud prevention and platform analytics service providers under strict contractual data processing limitations.
• Regulatory and law enforcement authorities: ph354 is required by Philippine law and PAGCOR regulations to disclose player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and law enforcement authorities where required by lawful order, warrant, or regulatory direction.
• Professional advisers: ph354's lawyers, auditors, and compliance consultants may access personal data on a confidential basis where necessary for the performance of their professional services.

All third parties who receive personal data from ph354 are subject to contractual data protection obligations and are prohibited from processing that data for any purpose beyond the specific purpose for which it was shared.

§8 Cookies & Tracking Technologies

ph354.org uses cookies and similar tracking technologies to operate the Platform, maintain your login session, and collect analytics data. The following categories of cookies are used on ph354.org:

• Strictly necessary cookies: These cookies are essential to the operation of ph354.org and cannot be disabled without breaking core platform functionality. They include your session authentication token, CSRF protection cookies, and load balancing cookies. No personal data beyond what is necessary for session management is stored in these cookies.
• Functional cookies: These cookies remember your preferences — such as your preferred language, remembered login identifier (if "Remember Me" is enabled), and display settings — to improve your experience on return visits.
• Analytics cookies: ph354 uses anonymised analytics cookies to understand how players navigate the platform, which game categories are most accessed, and where technical performance issues occur. This data is aggregated and does not identify individual players.
• Fraud prevention cookies: ph354 uses device fingerprinting and related technologies to detect multi-accounting, bonus abuse, and fraudulent access patterns. These operate as a security measure and cannot be disabled by players without restricting their account access.

You may configure your browser to refuse or delete cookies at any time. Note that disabling strictly necessary cookies will prevent you from logging in to and using ph354.org. ph354 does not use advertising cookies or share cookie data with third-party advertising networks.

§9 Data Retention

ph354 retains personal data for the periods specified below, after which data is securely deleted or irreversibly anonymised:

• Account and registration data: Retained for the duration of your active account and for five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• KYC and identity verification documents: Retained for five (5) years from the date of the last transaction on your account, as required by the Anti-Money Laundering Act of 2001 (as amended by RA 10365 and RA 11521).
• Financial and transaction records: Retained for five (5) years from the date of each transaction for tax compliance and AMLC reporting purposes.
• Gameplay and session logs: Retained for three (3) years from the date of each session for dispute resolution and PAGCOR audit purposes.
• Customer support communications: Retained for two (2) years from the date of the interaction for quality assurance and dispute resolution.
• Marketing opt-in records: Retained for as long as you remain opted in to receive marketing communications, plus three (3) years following opt-out to demonstrate historical consent compliance.
• Self-exclusion records: Retained indefinitely for accounts subject to permanent self-exclusion, to prevent re-registration by excluded players.

§10 Data Security

ph354 implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your device and ph354 servers is encrypted using 256-bit TLS/SSL protocols. ph354.org enforces HTTPS with HSTS (HTTP Strict Transport Security).
• Encryption at rest: Sensitive personal data — including KYC documents, financial records, and account credentials — is encrypted at rest on ph354 servers using AES-256 encryption.
• Access controls: Access to player personal data within ph354 is restricted on a strict need-to-know basis using role-based access controls. All internal access to production data is logged and audited.
• Password security: Player passwords are hashed using industry-standard cryptographic algorithms. ph354 never stores passwords in plain text or in reversible encrypted form.
• OTP verification: Login from new devices requires OTP verification via your registered Philippine mobile number, providing a second layer of account security beyond the password.
• Breach response: In the event of a personal data breach that is likely to result in a risk to your rights, ph354 will notify affected players and the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03.

While ph354 takes all reasonable measures to protect your personal data, no internet transmission is 100% secure. You are responsible for maintaining the security of your own account credentials and for notifying ph354 immediately if you suspect unauthorised access to your account.

§11 Children's Privacy

ph354 is strictly an adult platform. Access is limited to individuals who are at least twenty-one (21) years of age, as required by PAGCOR regulations governing online gaming in the Philippines. ph354 does not knowingly collect personal data from individuals under the age of 21.

If ph354 discovers that personal data has been submitted by or on behalf of an individual under 21 years of age, ph354 will immediately close the associated account, delete the personal data submitted, and — where applicable — return any deposited funds to the payment method from which they were received, subject to verification that the payment method belongs to the account holder.

If you are a parent or guardian and believe that a minor has registered an account on ph354.org, please contact ph354 immediately via live chat or by email so that appropriate action can be taken without delay.

§12 Cross-Border Data Transfers

Some of ph354's third-party service providers — including certain game providers and platform technology partners — may process personal data outside the Republic of the Philippines. Where such cross-border transfers occur, ph354 ensures that appropriate safeguards are in place to protect your data to a standard consistent with the Data Privacy Act of 2012.

Safeguards for cross-border transfers may include: contractual data processing agreements incorporating standard data protection clauses; transfer to countries recognised as providing an adequate level of data protection under NPC guidelines; or, where no adequacy determination exists, implementation of binding corporate rules or specific technical and organisational measures that achieve equivalent protection.

For information about the specific safeguards applicable to cross-border transfers of your personal data, please contact ph354's Data Protection Officer via the details provided in Section 15.

§13 Marketing Communications

ph354 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, and platform updates, subject to your marketing preferences at the time of registration or as subsequently updated by you in your account settings.

• Opt-in: Marketing communications are sent only where you have opted in at registration or have subsequently opted in via your account settings. Opt-in is not a condition of using ph354 and does not affect your access to any platform features.
• Opt-out: You may withdraw consent to receive marketing communications at any time by updating your notification preferences in your account settings or by contacting ph354 support. Opt-out requests are processed within five (5) business days. After opt-out, you will continue to receive transactional and account-related communications that are necessary for the operation of your account.
• No third-party marketing: ph354 does not share your contact details with third-party marketing organisations. Marketing communications from ph354 are sent only by ph354 directly.
• Self-excluded players: ph354 will not send marketing communications to players who have activated a self-exclusion or cooling-off period. Exclusion from marketing is applied automatically at the time of self-exclusion.

§14 Amendments to This Privacy Policy

ph354 may update this Privacy Policy from time to time to reflect changes in applicable Philippine law, PAGCOR regulatory requirements, our data processing practices, or the services we offer. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made.

Where amendments are material — meaning they substantially affect how your personal data is collected, used, or shared — ph354 will notify registered players via the email address on their account no fewer than seven (7) days before the revised Policy takes effect. For non-material changes (such as typographical corrections or clarifications that do not affect the substance of our data processing practices), the revised Policy will be published on ph354.org without individual notification.

ph354 recommends that you review this Privacy Policy periodically. Your continued use of ph354.org after the effective date of any revision constitutes your acknowledgement of the revised Policy.

§15 Contact & Data Protection Officer

For questions about this Privacy Policy, to exercise your data subject rights under the Data Privacy Act of 2012, or to raise a data privacy concern, please contact ph354 through the following channels:

• Live Chat: Available 24/7 from ph354.org. For data subject right requests, please state "Data Privacy Request" at the start of the conversation so your query is routed to the appropriate team.
• Email: [email protected] — for non-urgent data privacy matters. Use the subject line "Data Privacy Request" or "Attention: Data Protection Officer" as appropriate.

ph354 will acknowledge data subject right requests within three (3) business days and provide a substantive response within fifteen (15) business days of the acknowledgement. In complex cases where additional time is required, ph354 will notify you of the extended timeline and the reason for the extension.