Privacy Policy — ph22ph

ph22ph is an online sportsbook and casino platform operating in the Philippines under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR). ph22ph offers sports betting markets across PBA basketball, NBA, UFC, boxing, and football, as well as live casino games, slots, bingo, keno, and other gaming products to registered Filipino members aged 21 and above.

ph22ph acts as the data controller for all personal information collected through the ph22ph.net website and associated mobile platforms. As data controller, ph22ph determines the purposes and means by which your personal data is processed, in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR).

ph22ph collects personal data in the following categories. We apply the principle of data minimisation — meaning we only collect what is genuinely necessary for the stated purpose.

ph22ph collects personal data through the following channels and mechanisms:

• Account Registration: When you create a ph22ph account, you voluntarily provide identity, contact, and account data through the registration form.
• KYC Verification Process: When ph22ph requests identity verification — at registration or before processing a withdrawal — you submit identity documents and, in some cases, a live selfie for facial matching.
• Deposits and Withdrawals: Financial transactions conducted through GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, and other payment channels generate financial and transaction data that is recorded in your account history.
• Platform Usage: Your interactions with ph22ph — including bets placed, games played, pages visited, and time spent on the platform — are logged automatically by our system for operational, analytical, and responsible gaming monitoring purposes.
• Customer Support: When you contact ph22ph support via email at [email protected] or through the in-platform live chat, the contents of your communications are retained as part of your support record.
• Cookies and Tracking Technologies: ph22ph uses cookies, web beacons, and similar technologies to collect technical data about your device and browsing behaviour on our platform. See Section 7 for full details.
• Third-Party Verification Services: In order to comply with PAGCOR-mandated AML and KYC requirements, ph22ph may use third-party identity verification providers to cross-reference the data you supply during registration or verification.

ph22ph processes your personal data only where a lawful basis exists under RA 10173. The following table sets out the primary purposes for which we process personal data and the corresponding legal basis for each:

ph22ph does not sell, rent, or otherwise commercially disclose your personal data to third parties for their own marketing or commercial purposes. However, ph22ph shares personal data with the following categories of recipients where necessary and lawful:

• Payment Service Providers: To process your GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, Visa, or Mastercard transactions, ph22ph shares the minimum necessary financial data with the relevant payment processor. All payment partners are required to maintain data security standards equivalent to or higher than those maintained by ph22ph.
• KYC and Identity Verification Providers: To fulfil PAGCOR-mandated identity verification requirements, ph22ph may share your submitted identity documents with licensed third-party KYC verification service providers operating under binding data processing agreements.
• Game Content Providers: Where ph22ph's casino games, live dealer tables, or slot titles are provided by third-party game studios, certain gameplay session data may be shared with those providers solely for the purpose of delivering the game service.
• Regulatory Authorities: ph22ph is legally required to share data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies upon lawful request or as mandated by applicable regulations.
• Law Enforcement: ph22ph will disclose personal data to Philippine law enforcement agencies where required by a valid court order, subpoena, or other lawful process.
• Corporate Successors: In the event of a merger, acquisition, or sale of assets involving ph22ph, your personal data may be transferred to the successor entity, subject to the same or stronger privacy protections as set out in this Policy.

ph22ph retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your active membership plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act (AMLA).
• Financial and Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record-keeping requirements.
• KYC Documents: Retained for five (5) years following the conclusion of your relationship with ph22ph or as otherwise required by applicable regulation.
• Gaming and Session Logs: Retained for up to two (2) years from the date of each gaming session for responsible gaming monitoring, fraud prevention, and dispute resolution purposes.
• Support Communications: Retained for up to three (3) years from the date of the last interaction to facilitate follow-up support and quality assurance.
• Marketing Preferences and Consent Records: Retained for the duration of your membership and for one (1) year following account closure, to maintain an accurate record of your consent history.
• Technical and Cookie Data: Retained for periods ranging from session-only (for strictly necessary cookies) to up to two (2) years (for analytics cookies), as further described in Section 7.

Once the applicable retention period expires, ph22ph will securely delete or anonymise your personal data so that it can no longer be associated with you as an identifiable individual.

ph22ph uses cookies and similar tracking technologies (including web beacons and local storage objects) to make the platform work correctly, remember your preferences, and understand how members use our site so we can keep improving it. The cookies we use fall into the following categories:

You may manage your cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies will affect the functionality of the ph22ph platform, and you may be unable to log in or place bets if these cookies are blocked.

ph22ph implements a comprehensive, layered security programme to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• Encryption: All data transmitted between your browser and the ph22ph platform is encrypted using TLS 1.3. Personal and financial data stored on ph22ph servers is encrypted at rest using AES-256.
• Access Controls: Personal data is accessible only to ph22ph staff and contractors who have a legitimate operational need to access it. All staff with data access are subject to confidentiality obligations and regular data privacy training.
• Two-Factor Authentication (2FA): ph22ph offers optional 2FA for member accounts and mandates 2FA for all internal staff accounts with access to member data.
• Penetration Testing: ph22ph conducts regular security assessments and third-party penetration tests to identify and remediate vulnerabilities in our platform.
• Incident Response: ph22ph maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, ph22ph will notify the National Privacy Commission (NPC) within 72 hours of discovery, and affected members will be notified without undue delay.
• Payment Security: ph22ph does not store full payment card numbers or GCash PINs on its servers. Payment transactions are processed through PAGCOR-compliant payment gateways that maintain their own PCI-DSS compliance certifications.

Under Republic Act No. 10173 (the Data Privacy Act of 2012), all ph22ph members who are Philippine residents hold the following rights with respect to their personal data:

1. Right to Be Informed: You have the right to know what personal data ph22ph collects about you, why it is collected, how it is used, and with whom it is shared. This Policy fulfils ph22ph's obligation to inform you.
2. Right to Access: You may request a copy of the personal data ph22ph holds about you at any time. ph22ph will respond to verified access requests within fifteen (15) business days.
3. Right to Rectification: If any personal data ph22ph holds about you is inaccurate, incomplete, or outdated, you may request that it be corrected. You may update basic account details directly in your account settings.
4. Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to ph22ph's legal retention obligations under PAGCOR regulations and AMLA.
5. Right to Data Portability: You may request that ph22ph provide your personal data in a structured, commonly used, and machine-readable format for transfer to another service provider, where technically feasible.
6. Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on ph22ph's legitimate interests, subject to applicable legal exceptions.
7. Right to Lodge a Complaint: If you believe ph22ph has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the rights listed above, please contact ph22ph's Data Protection Officer at [email protected] with the subject line "Data Privacy Request". ph22ph may require you to verify your identity before processing your request to prevent unauthorised disclosure of your data.

ph22ph is a gambling platform and is strictly prohibited from being accessed by persons under the age of 21, as mandated by PAGCOR regulations governing online gaming in the Philippines. ph22ph does not knowingly collect personal data from individuals below the age of 21.

During registration, all applicants are required to provide their date of birth and, upon request, a valid government-issued Philippine identification document confirming their age. Applications from persons found to be under 21 years of age are immediately rejected, and any accounts subsequently discovered to belong to underage individuals will be permanently closed and all balances forfeited.

ph22ph primarily processes and stores personal data on servers located within or serving the Philippines. However, in limited circumstances, personal data may be transferred to or accessed from jurisdictions outside of the Philippines — for example, where ph22ph engages third-party game content providers, KYC verification services, or cloud infrastructure providers whose operations involve servers in other countries.

Where such cross-border transfers occur, ph22ph ensures that appropriate safeguards are in place to protect your personal data, including:

• Executing data processing agreements with all third-party recipients that impose data protection obligations equivalent to those required under RA 10173.
• Transferring data only to jurisdictions or recipients where an adequate level of data protection is ensured, as assessed by ph22ph's Data Protection Officer in accordance with NPC guidelines.
• Restricting transferred data to the minimum necessary for the specific purpose of the transfer.

ph22ph does not transfer personal data to foreign entities for commercial exploitation, advertising profiling, or any purpose unrelated to the delivery of ph22ph's services to its Philippine members.

ph22ph may update this Privacy Policy from time to time to reflect changes in our data processing practices, updates to Philippine data privacy laws, PAGCOR regulatory requirements, or improvements to our platform and services. The most current version of this Policy is always available at ph22ph.net/privacy-policy.

When ph22ph makes material changes to this Policy — changes that significantly affect your rights or how your data is processed — we will notify you by:

• Sending an email notification to the address registered with your ph22ph account; and/or
• Displaying a prominent notice on the ph22ph platform upon your next login.

Your continued use of the ph22ph platform after a revised Privacy Policy has been published constitutes your acceptance of the updated terms. If you do not agree with any changes to this Policy, you should cease using the ph22ph platform and request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way ph22ph handles your personal data, you are encouraged to reach out to our dedicated Data Protection Officer (DPO). The DPO is responsible for overseeing ph22ph's compliance with RA 10173 and serves as your primary point of contact for all data privacy matters.

You may contact ph22ph's Data Protection Officer through the following channel:

• Email: [email protected] — please use the subject line "Data Privacy Request" or "DPO Inquiry" so your message is routed correctly.
• Response Time: ph22ph aims to acknowledge all data privacy inquiries within three (3) business days and to provide a substantive response within fifteen (15) business days of receiving a verified request.

If you are not satisfied with ph22ph's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the independent government authority responsible for enforcing RA 10173.