phl99 Privacy Policy

This Privacy Policy ("Policy") is issued by phl99 ("phl99," "we," "us," or "our"), the operator of the online gaming platform accessible at phl99.app. This Policy explains how phl99 collects, processes, stores, shares, and protects personal data that you ("User," "Player," or "you") provide or that is generated when you use the phl99 Service.

This Policy applies to all users of phl99, including registered account holders, visitors to phl99.app who have not yet registered, and individuals who contact phl99 support. It covers data collected through the phl99 website, mobile browser interface, customer support channels, and any other means by which you interact with phl99.

phl99 is committed to compliance with applicable Philippine data privacy legislation, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines.

phl99 collects personal data through multiple channels and in various categories depending on how you interact with the platform. The following table summarizes the main categories of personal data collected:

phl99 does not collect sensitive personal information (as defined under RA 10173) unless it is strictly necessary for KYC compliance, responsible gaming assessment, or legal obligations, and only with appropriate safeguards in place.

phl99 processes your personal data only for specific, legitimate purposes. The primary purposes for which phl99 uses your data include:

• Account creation and management: Processing your registration, verifying your identity, managing your account settings, and maintaining your account balance and transaction history;
• Service delivery: Enabling you to access games, process deposits and withdrawals, apply bonuses, and participate in promotions on the phl99 platform;
• KYC and AML compliance: Verifying your age (21+ requirement), identity, and source of funds as required under applicable Philippine financial regulations and anti-money laundering obligations;
• Customer support: Responding to your queries, resolving disputes, and improving support processes using communication records;
• Security and fraud prevention: Detecting and preventing unauthorized account access, bonus abuse, collusion, money laundering, and other fraudulent or illegal activity;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators and contacting players where responsible gaming concerns arise;
• Platform improvement: Analyzing aggregate, anonymized usage data to improve the phl99 platform, user experience, and game offerings;
• Marketing communications: Sending you promotional offers, bonus notifications, and news about phl99 — only where you have provided consent and subject to your opt-out rights at any time.

Under the Data Privacy Act of 2012, phl99 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to fulfil our obligations under the phl99 Terms & Conditions (account management, payment processing, game delivery);
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, KYC requirements, tax reporting obligations, and PAGCOR-related compliance;
• Legitimate interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming oversight, where such interests are not overridden by your rights;
• Consent: Processing for direct marketing communications and non-essential cookies, where you have provided explicit consent and retain the right to withdraw that consent at any time.

phl99 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data processing agreements and confidentiality obligations:

• Payment processors: GCash (Mynt/Globe Fintech), Maya (PayMaya Philippines), banks (BPI, BDO, Metrobank, UnionBank), and card networks (Visa, Mastercard) — for processing deposits and withdrawals;
• KYC/identity verification providers: Third-party identity verification services used to authenticate your government-issued documents;
• Game software providers: Providers of casino game software may receive limited technical data (e.g., session tokens, bet data) necessary to deliver game functionality;
• Cloud and technology providers: Cloud hosting, database, and security infrastructure providers operating under strict data processing agreements;
• Regulatory and law enforcement authorities: Philippine government agencies (including PAGCOR, AMLC, NPC, and law enforcement bodies) where disclosure is required by law, court order, or regulatory directive;
• Fraud prevention networks: Industry-standard fraud and AML screening services used to identify high-risk activity.

All third-party data processors engaged by phl99 are contractually required to maintain the confidentiality and security of your personal data and to process it only for the specified purpose for which it was shared.

phl99 uses cookies and similar tracking technologies to operate the platform, enhance user experience, and analyze usage patterns. The categories of cookies used by phl99 are as follows:

• Strictly necessary cookies: Required for core platform functionality such as session authentication, secure login, and balance display. These cookies cannot be disabled without impairing platform functionality;
• Functional cookies: Remember your preferences such as language settings, display preferences, and "Remember Me" login state to improve your experience across sessions;
• Analytics cookies: Aggregate, anonymized data on page views, navigation patterns, and game category popularity used to improve platform design and content;
• Security cookies: Used to detect and prevent fraudulent sessions, bot activity, and unauthorized access attempts.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the phl99 platform. phl99 does not use advertising or cross-site tracking cookies for third-party marketing purposes.

phl99 retains your personal data for as long as your account remains active and for such additional periods as are required by applicable law or legitimate business necessity. The following retention guidelines apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required under Philippine AML regulations (AMLA and FATF guidelines);
• Financial and transaction records: Retained for a minimum of five (5) years from the date of each transaction in accordance with BIR and AMLC record-keeping requirements;
• KYC documents: Retained for the duration required by applicable regulatory obligations, typically five (5) years post-account closure;
• Support communications: Retained for three (3) years from the date of the interaction or until the underlying issue is fully resolved;
• Technical and gaming data: Retained for up to two (2) years for analytics and fraud detection purposes, then anonymized or deleted.

phl99 implements technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Key security measures include:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between your device and phl99's servers;
• Encryption at rest for sensitive personal data and financial records stored in phl99's databases;
• Strict access controls limiting personal data access to authorized phl99 personnel on a need-to-know basis;
• Two-factor authentication (2FA) available to all account holders as an additional layer of login security;
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified information security professionals;
• Incident response procedures for detecting, containing, and notifying affected users and the NPC of any personal data breach within required timeframes.

While phl99 takes all reasonable precautions to protect your personal data, no security system is infallible. You are responsible for maintaining the security of your own account credentials and for notifying phl99 immediately if you suspect unauthorized account access.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phl99:

• Right to be informed: The right to know what personal data phl99 collects and how it is used — this Policy fulfils that obligation;
• Right of access: The right to request a copy of the personal data phl99 holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data, subject to phl99's legal retention obligations;
• Right to object: The right to object to processing of your personal data for direct marketing purposes at any time;
• Right to data portability: The right to receive your personal data in a structured, commonly used format;
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) if you believe your data rights have been violated.

To exercise any of the above rights, contact phl99's Data Protection Officer at [email protected] with the subject line "Data Privacy Request." phl99 will respond to valid requests within thirty (30) days in accordance with the NPC's prescribed timeframes.

phl99 does not knowingly collect personal data from individuals under the age of 21. The phl99 Service is strictly for adults aged 21 and above in accordance with Philippine gambling regulations. If phl99 becomes aware that personal data has been collected from a person under 21 years of age, the associated account will be immediately closed, the data will be deleted, and any funds in the account will be handled in accordance with applicable law. Parents or guardians who believe a minor has registered with phl99 should contact [email protected] immediately.

phl99 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, phl99 will provide notice to registered users via email or in-platform notification prior to the changes taking effect, with a minimum notice period of seven (7) days except where immediate changes are required by law. The date of the most recent revision is displayed at the top of this page. Your continued use of the phl99 Service after the effective date of any revision constitutes your acceptance of the updated Policy.

For all questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by phl99, please contact our Data Protection Officer:

If you are not satisfied with phl99's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which oversees enforcement of the Data Privacy Act of 2012.