phmacoa Privacy Policy

phmacoa ("we," "us," or "our") is committed to protecting the personal information of every Filipino player who uses our online gaming platform at phmacoa.com. This Privacy Policy has been prepared in accordance with the Philippine Data Privacy Act of 2012 (Republic Act 10173), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC).

This Privacy Policy applies to all personal data collected and processed through the phmacoa website, mobile application, customer support channels, and any other service operated under the phmacoa brand. By creating an account or using the phmacoa platform in any manner, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

For the purposes of the Philippine Data Privacy Act and this Privacy Policy, phmacoa acts as the Personal Information Controller (PIC) in respect of personal data collected through the phmacoa Platform. This means phmacoa determines the purposes and means of processing your personal data.

Certain third-party service providers engaged by phmacoa — including payment processors, RNG certification bodies, and cloud infrastructure providers — act as Personal Information Processors (PIP) and process personal data only on phmacoa's documented instructions, under binding contractual obligations that meet the standards required by RA 10173.

phmacoa has registered a Data Protection Officer (DPO) with the National Privacy Commission. The DPO's contact details are provided in Section 16 of this Policy.

phmacoa collects the following categories of personal data, depending on how you interact with the Platform:

phmacoa collects personal data through the following channels and mechanisms:

• 4.1 Direct collection: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal request, contact support, or update your account settings.
• 4.2 Automated collection: Technical and gameplay data collected automatically as you interact with the Platform through cookies, server logs, session tracking, and platform analytics tools.
• 4.3 Third-party sources: Identity verification data from accredited KYC service providers; transaction confirmation data from payment processors (GCash, Maya, BPI, BDO); fraud risk signals from licensed security services operating under data processing agreements with phmacoa.
• 4.4 Regulatory sources: In limited circumstances, phmacoa may receive data from PAGCOR, AMLC, or other Philippine regulatory bodies pursuant to lawful regulatory processes.

phmacoa processes your personal data for the following clearly defined purposes:

• Account creation and management — setting up and maintaining your phmacoa account, authenticating your identity at login, and managing account settings.
• Payment processing — processing deposits and withdrawals, verifying payment method ownership, and maintaining transaction records required by PAGCOR and BIR regulations.
• Regulatory compliance — fulfilling obligations under PAGCOR's licensing conditions, AMLA reporting requirements, AMLC directives, and other applicable Philippine law.
• KYC and identity verification — confirming your identity and age (21+) as required by law and phmacoa's Terms and Conditions.
• Fraud prevention and security — detecting, investigating, and preventing fraudulent activity, unauthorized account access, and abuse of the Platform.
• Responsible gaming — monitoring for signs of problem gambling, applying player-requested self-exclusion or deposit limit restrictions, and delivering responsible gaming information.
• Customer support — responding to your queries, resolving disputes, and maintaining records of support interactions.
• Platform improvement — analyzing aggregated and anonymized usage data to improve Platform performance, game selection, and user experience.
• Direct communications — sending you transaction confirmations, account security alerts, and — where you have opted in — promotional communications about phmacoa offers relevant to Filipino players.

phmacoa does not use your personal data for automated profiling that produces decisions with legal or similarly significant effects on you without human review available upon request.

Under Section 12 of the Philippine Data Privacy Act, phmacoa relies on the following legal bases for processing personal data:

• 6.1 Consent (Section 12[a]): Where you have given explicit consent to processing for a specific purpose — such as opting into promotional communications or consenting to KYC document collection.
• 6.2 Contractual necessity (Section 12[b]): Processing necessary to perform the phmacoa Terms & Conditions contract with you, including account management and payment processing.
• 6.3 Legal obligation (Section 12[c]): Processing required for compliance with Philippine law — including PAGCOR regulations, AMLA obligations, BIR reporting, and the Data Privacy Act itself.
• 6.4 Legitimate interests (Section 12[f]): Processing for phmacoa's legitimate interests in fraud prevention, platform security, and responsible gaming management, where those interests are not overridden by your privacy rights.

phmacoa shares personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Regulatory authorities: PAGCOR, AMLC, BIR, NPC, and other competent Philippine government bodies where phmacoa is legally required to disclose data pursuant to lawful regulatory processes or court orders.
• Payment processors: GCash (G-Xchange, Inc.), Maya (Voyager Innovations), Philippine commercial banks, and other licensed payment service providers, solely for the purpose of processing your financial transactions.
• KYC service providers: Accredited identity verification services engaged to assist phmacoa in fulfilling its KYC obligations, operating under binding data processing agreements.
• Cloud and infrastructure providers: Hosting and cloud services that store and process phmacoa Platform data within secure, encrypted environments, subject to contractual data protection obligations.
• Security and fraud prevention services: Licensed cybersecurity services engaged to protect the Platform and detect fraudulent activity, operating under strict data minimization protocols.
• Professional advisers: Legal, audit, and compliance advisers engaged by phmacoa on a confidential basis where necessary to obtain professional advice.

phmacoa does not share personal data with advertising networks, data brokers, or any third party for commercial marketing purposes. In the event of a corporate restructuring, merger, or acquisition involving phmacoa, player data will be subject to the same level of protection under any successor entity and you will be notified of any material change in the data controller's identity.

phmacoa retains personal data for the minimum period necessary to fulfill the purposes for which it was collected, or as required by Philippine law, whichever is longer.

• 8.1 Account and identity data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA regulations.
• 8.2 Financial transaction records: Retained for a minimum of ten (10) years from the date of each transaction, in compliance with AMLA record retention obligations.
• 8.3 KYC documents: Retained for a minimum of five (5) years post-account closure or five (5) years from the date of last transaction, whichever is later.
• 8.4 Support communications: Retained for three (3) years from the date of the last interaction, unless a longer retention period is required in connection with an ongoing dispute or legal proceeding.
• 8.5 Marketing consent records: Retained for the duration of your active marketing subscription plus three (3) years, to evidence consent in the event of a complaint.

Upon expiry of the applicable retention period, phmacoa will securely delete or anonymize personal data so that it can no longer be associated with an identifiable individual.

phmacoa implements technical and organizational security measures appropriate to the risk level associated with personal data processing on a licensed online gaming platform, including:

• AES-256 encryption for all personal data at rest on phmacoa servers.
• TLS 1.3 encryption for all data in transit between your device and phmacoa's infrastructure.
• Multi-factor authentication requirements for administrative access to systems holding personal data.
• Regular penetration testing and vulnerability assessments conducted by accredited third-party security firms.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Continuous security monitoring and intrusion detection systems operating on phmacoa's server environment.
• Formal data breach response procedures with defined escalation paths and NPC notification timelines.

Despite these measures, no online platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your phmacoa account credentials and for notifying phmacoa immediately of any suspected unauthorized access to your account.

The phmacoa Platform uses cookies and similar tracking technologies to provide platform functionality, maintain your logged-in session, and analyze aggregated usage patterns. The following categories of cookies are used on phmacoa:

• 10.1 Strictly necessary cookies: Required for the Platform to function — including session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• 10.2 Functional cookies: Remember your preferences such as language settings and region selections to personalize your experience without requiring repeated input.
• 10.3 Analytics cookies: Collect anonymized data about how players use the Platform — which pages are visited, how long sessions last, and which features are used most frequently — to help phmacoa improve the Platform experience.

phmacoa does not use third-party advertising cookies or tracking pixels that share your personal data with external advertising networks. You may manage cookie preferences through your browser settings, though disabling strictly necessary cookies will impair your ability to use the Platform.

As part of our registration and KYC process, phmacoa verifies the age of all registered players using government-issued identification documents. Any account found to belong to a person under 21 will be immediately and permanently closed, all associated funds handled in accordance with applicable law, and the matter reported to PAGCOR as required.

If you are a parent or guardian and believe a person under 21 in your care has registered on the phmacoa Platform, please contact us immediately at [email protected]. phmacoa will treat such reports as priority matters and will investigate and respond within 24 hours.

To exercise any of your data subject rights under RA 10173 (as summarized in the "Your Rights" section above), you may submit a written request to phmacoa's Data Protection Officer. Requests may be submitted via:

• Email (plain text — not a link): [email protected] — subject line: "Data Subject Rights Request"
• In-Platform: Via the Data Privacy section in your phmacoa Account settings.

To protect your data and prevent unauthorized requests, phmacoa will require identity verification before processing any data subject rights request. This will typically involve confirming your registered mobile number, username, and one additional identity factor.

phmacoa will acknowledge data subject rights requests within forty-eight (48) hours and will respond substantively within fifteen (15) business days of receiving a verified request. Complex requests may take up to thirty (30) business days; you will be notified of any extension.

Please note that certain rights — particularly the right to erasure — are subject to overriding legal obligations. phmacoa cannot delete data that it is required by Philippine law (including AMLA and PAGCOR regulations) to retain for a defined period.

In the event of a personal data breach that is reasonably believed to present a real risk of serious harm to affected data subjects, phmacoa will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required by NPC Circular 16-03.
• Notify affected players without undue delay where the breach is likely to result in harm to their rights and freedoms, including financial harm or identity theft risk.
• Provide affected players with a description of the nature of the breach, the likely consequences, and the measures phmacoa has taken or proposes to take to address it.

Notifications will be sent to the contact details registered on your phmacoa account. phmacoa maintains a formal incident response plan and conducts regular drills to ensure readiness to respond to security incidents in accordance with NPC requirements.

phmacoa's primary data processing infrastructure is located within the Philippines. Where phmacoa engages third-party service providers whose servers or operations are located outside the Philippines — such as certain cloud infrastructure or security service providers — personal data may be transferred to those jurisdictions.

Any such cross-border transfer is conducted only where:

• The receiving country or organization provides an adequate level of protection under standards recognized by the NPC; or
• Appropriate safeguards are in place including binding contractual clauses that impose data protection obligations meeting the standards required by RA 10173; or
• The transfer is necessary for the performance of the contract between phmacoa and you, or for pre-contractual steps taken at your request.

Where your data is transferred internationally, phmacoa implements equivalent technical and organizational protections — including encryption in transit and contractual data minimization requirements — regardless of the receiving jurisdiction.

phmacoa reserves the right to update this Privacy Policy from time to time to reflect changes in the Platform, applicable law, regulatory guidance from the NPC or PAGCOR, or our data processing practices. The "Effective Date" at the top of this Policy indicates when the current version came into force.

Material changes to this Privacy Policy — particularly those that affect your rights or the manner in which phmacoa uses your personal data in a significant way — will be communicated to registered players via email or in-platform notification at least fourteen (14) days before the revised Policy takes effect. Your continued use of the phmacoa Platform after the effective date of a revised Policy constitutes your acknowledgment of the changes.

The current version of this Privacy Policy is always accessible at phmacoa.com/privacy-policy. Previous versions are available on request from the DPO.

For any questions, concerns, or requests relating to this Privacy Policy or to the handling of your personal data by phmacoa, please contact our Data Protection Officer:

If you are not satisfied with phmacoa's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) through the NPC's official complaint and enforcement channels.