phsaya Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how phsaya ("phsaya," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you," "your," or "Player") who access or use the phsaya online casino platform, including the phsaya website at phsaya.app and any associated mobile applications or services (collectively, the "Platform").

phsaya is committed to protecting your privacy and handling your personal data responsibly, transparently, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

By registering a phsaya account, accessing the Platform, or otherwise providing your personal information to phsaya, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, please do not use the phsaya Platform.

2. Data Controller Information

phsaya acts as the data controller for personal data collected through the Platform. As data controller, phsaya determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection laws.

phsaya has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data privacy regulations. You may contact the phsaya DPO through the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 Registration and Account Data

When you create a phsaya account, we collect the following information:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Email address;
• Mobile phone number;
• Residential address (including city, province, and postal code);
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

To comply with PAGCOR requirements and Philippine anti-money laundering regulations, phsaya may collect:

• Government-issued photo ID (e.g., PhilSys ID, passport, driver's license, UMID, SSS ID, voter's ID);
• Proof of address (e.g., utility bill, bank statement);
• Selfie or live photo for identity verification purposes.

3.3 Financial and Transaction Data

• GCash or Maya account details (mobile number associated with the account);
• Bank account details for bank transfer transactions;
• Debit card details (card number, expiry date — stored in tokenized form only);
• Transaction history, including deposits, withdrawals, and gaming activity.

3.4 Technical and Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session duration, pages visited, and features used on the Platform;
• Cookie identifiers and similar tracking data (see Section 10).

3.5 Communications Data

Records of your communications with phsaya support, including live chat transcripts, email correspondence, and any feedback or complaints submitted through the Platform.

4. How We Collect Your Data

phsaya collects your personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions;
• Automatically: Through cookies, web beacons, and similar technologies when you access and use the Platform (see Section 10);
• From third parties: From payment processors (GCash, Maya, banks), KYC verification providers, fraud prevention services, and regulatory authorities where required by law.

5. How We Use Your Personal Data

phsaya uses your personal data for the following purposes:

• Account management: To create, maintain, and manage your phsaya account;
• Identity verification: To verify your age (21+) and identity in compliance with PAGCOR and AML requirements;
• Transaction processing: To process deposits, withdrawals, and gaming transactions in Philippine Peso (PHP);
• Platform operation: To provide, maintain, and improve the phsaya Platform and its features;
• Customer support: To respond to your queries, complaints, and support requests;
• Promotions and communications: To send you information about phsaya promotions, bonuses, and updates (where you have consented to receive such communications);
• Responsible gaming: To monitor gaming activity and implement responsible gaming tools, including deposit limits and self-exclusion;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, and other illegal conduct;
• Legal compliance: To comply with applicable Philippine laws, regulations, and regulatory directives, including PAGCOR requirements and AML obligations;
• Analytics: To analyze Platform usage patterns and improve the user experience for Filipino players.

6. Legal Basis for Processing

phsaya processes your personal data on the following legal bases under the Philippine Data Privacy Act:

• Consent: Where you have given your explicit consent to the processing of your personal data for a specific purpose (e.g., receiving promotional communications);
• Contractual necessity: Where processing is necessary to perform our contract with you (i.e., to operate your phsaya account and provide gaming services);
• Legal obligation: Where processing is required to comply with applicable Philippine laws and regulations, including PAGCOR licensing requirements and AML obligations;
• Legitimate interests: Where processing is necessary for phsaya's legitimate interests, such as fraud prevention, platform security, and service improvement, provided that such interests are not overridden by your rights and interests.

7. Sharing Your Personal Data

phsaya does not sell, rent, or trade your personal data to third-party marketers. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: GCash, Maya, and Philippine banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) to process your transactions;
• KYC and identity verification providers: Third-party services engaged to verify your identity and age in compliance with regulatory requirements;
• Fraud prevention and security services: Third-party providers engaged to detect and prevent fraudulent activity on the Platform;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where required by law;
• IT and infrastructure providers: Cloud hosting, data storage, and technical service providers engaged to operate the Platform, subject to strict data processing agreements;
• Professional advisers: Legal, accounting, and auditing professionals engaged by phsaya, subject to professional confidentiality obligations.

All third parties with whom phsaya shares personal data are required to implement appropriate technical and organizational measures to protect your data and to process it only in accordance with phsaya's instructions and applicable law.

8. Data Retention

phsaya retains your personal data for as long as necessary to fulfill the purposes for which it was collected, including for the duration of your phsaya account and for a period thereafter as required by applicable law.

Specifically:

• Account and KYC data: Retained for a minimum of 5 years following account closure, in compliance with Philippine AML regulations;
• Transaction records: Retained for a minimum of 5 years following the date of the transaction;
• Support communications: Retained for 3 years following the resolution of the relevant query or complaint;
• Technical and usage data: Retained for up to 2 years from the date of collection.

Upon expiry of the applicable retention period, phsaya will securely delete or anonymize your personal data in accordance with its data disposal procedures.

9. Data Security

phsaya implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phsaya Platform;
• Encryption of sensitive data at rest, including payment card details (stored in tokenized form only);
• Two-factor authentication (2FA) for phsaya account access;
• Regular security audits and penetration testing;
• Strict access controls limiting employee access to personal data on a need-to-know basis;
• Comprehensive staff training on data privacy and security obligations.

While phsaya takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, phsaya will notify you and the National Privacy Commission in accordance with the requirements of the Data Privacy Act.

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the phsaya Platform. They help phsaya recognize your device, remember your preferences, and analyze how the Platform is used.

10.2 Types of Cookies Used by phsaya

• Essential cookies: Necessary for the Platform to function correctly, including session management and security features. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language settings, game lobby layout) to improve your experience on phsaya.
• Analytics cookies: Collect anonymized data about how players use the Platform to help phsaya improve its features and performance.
• Marketing cookies: Used to deliver relevant phsaya promotions and content. These are only placed with your consent.

10.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the phsaya Platform. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

11. Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phsaya:

• Right to be informed: The right to be informed of how your personal data is collected, used, and processed by phsaya;
• Right of access: The right to request a copy of the personal data phsaya holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to phsaya's legal retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability: The right to receive your personal data in a structured, commonly used format and to transmit it to another data controller;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phsaya has violated your data privacy rights.

To exercise any of these rights, please contact phsaya's Data Protection Officer using the contact details in Section 14. phsaya will respond to all data subject requests within 15 business days of receipt.

12. Children's Privacy

The phsaya Platform is strictly intended for individuals aged 21 years and above. phsaya does not knowingly collect personal data from individuals under the age of 21. If phsaya becomes aware that personal data has been collected from a person under 21, it will take immediate steps to delete such data and close the associated account.

If you believe that phsaya may have inadvertently collected personal data from a minor, please contact phsaya support immediately using the details in Section 14.

13. Changes to This Privacy Policy

phsaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to registered phsaya players via email or a prominent notice on the Platform at least 14 days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the phsaya Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how phsaya protects your personal data.

14. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or phsaya's data processing practices, or if you wish to exercise your rights under the Data Privacy Act, please contact our Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 via the phsaya Platform
• General Support: [email protected]

If you are not satisfied with phsaya's response to your complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act.