ph38 Privacy Policy

1. Introduction

ph38 ("we," "us," "our") operates the online casino and sports betting platform at ph38.cam, serving Filipino players across the Philippines — from Metro Manila and Cebu City to Davao, Quezon City, and beyond. We understand that when you create an account and play on ph38, you are entrusting us with personal information. We take that responsibility seriously.

This Privacy Policy describes how ph38 collects, processes, stores, discloses, and protects your personal data in connection with your use of the Platform. It applies to all users of the ph38 website, mobile web application, and any related services.

By registering an Account on ph38 or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please discontinue use of the Platform immediately.

2. Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, ph38 is the personal information controller responsible for the personal data collected through the Platform. All questions, access requests, and complaints regarding your personal data should be directed to the ph38 Data Privacy contact set out in Section 16 of this Policy.

ph38 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act, the NPC's implementing rules, and this Privacy Policy. The DPO may be contacted via the support channels listed in Section 16.

3. Personal Data We Collect

ph38 collects the following categories of personal data about you:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID
• Date of birth (for age verification — players must be 21 or older)
• Philippine mobile number and email address
• Residential address in the Philippines
• Government-issued ID number and a copy of the ID document (for KYC)
• Selfie photograph (if required for enhanced KYC verification)

3.2 Account Data

• Username and encrypted password hash
• Account creation date and last login timestamp
• Account preferences and notification settings
• Two-factor authentication configuration

3.3 Financial & Transaction Data

• Deposit and withdrawal history in Philippine Peso (PHP)
• Payment method details (e.g., GCash-registered mobile number, Maya account reference, bank account details for BPI, BDO, Metrobank transfers)
• Bonus and promotion usage history
• Account balance records

3.4 Gaming Activity Data

• Game play history, wager amounts, and outcomes
• Session duration and frequency of play
• Responsible gaming tool configurations (deposit limits, session timers, self-exclusion status)

3.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Mobile network provider and connection type
• Platform access logs and error reports

3.6 Communications Data

• Records of support chat conversations and email correspondence
• Player feedback, dispute submissions, and responsible gaming requests
• Marketing communication preferences and opt-out records

4. How We Collect Your Data

ph38 collects personal data through the following channels:

• Direct submission: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact support, or submit a responsible gaming request.
• Automated collection: Through cookies, session tokens, and server logs as you interact with the Platform. See Section 8 for details on cookies.
• Third-party sources: From licensed KYC verification service providers, payment processors (GCash, Maya, BPI, BDO, Metrobank), fraud detection services, and — where legally required — public databases maintained by Philippine government authorities.
• Regulatory disclosure: In certain circumstances, regulatory or law enforcement bodies may provide us with information about a player as part of a lawful investigation. In such cases, ph38 processes the information strictly as required by law.

5. How We Use Your Personal Data

ph38 processes your personal data for the following purposes:

5.1 Account Management

To create, maintain, verify, and administer your ph38 Account, including processing your KYC documents to confirm your identity and age (21+ requirement) in compliance with PAGCOR regulations.

5.2 Service Delivery

To provide you with access to casino games, sports betting, bingo, live dealer tables, and all other platform features. This includes processing deposits and withdrawals in PHP through your chosen payment method (GCash, Maya, bank transfer, etc.).

5.3 Legal & Regulatory Compliance

To comply with our obligations under Philippine gaming regulations, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and any lawful request from PAGCOR, the AMLC, the NPC, or other competent Philippine authorities.

5.4 Fraud Prevention & Security

To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, unauthorized access, and other prohibited conduct described in our Terms & Conditions.

5.5 Responsible Gaming

To administer the responsible gaming tools available on ph38, including enforcing deposit limits, processing self-exclusion requests, and identifying players who may need intervention based on gaming behavior patterns.

5.6 Customer Support

To respond to your enquiries, resolve disputes, and provide technical assistance. Support communications are retained for quality assurance and regulatory audit purposes.

5.7 Marketing Communications

To send you promotional offers, bonus notifications, and platform updates via email or SMS — but only where you have provided valid consent or where we have a legitimate interest in doing so, and subject always to your right to opt out at any time.

5.8 Platform Improvement

To analyze aggregated usage data and improve the performance, speed, and features of the ph38 Platform, with particular focus on the mobile experience for Filipino players.

6. Legal Basis for Processing

ph38 processes your personal data on the following legal grounds under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our contractual obligations to you under the ph38 Terms & Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, AMLA obligations, and NPC regulations.
• Legitimate interest: Processing for fraud detection, security monitoring, platform improvement, and — where proportionate — direct marketing to existing players.
• Consent: Processing of data for purposes not covered by the above grounds, including certain marketing activities and optional data sharing. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

7. Data Sharing & Disclosure

ph38 does not sell your personal data. We share your data only in the following limited circumstances:

7.1 Service Providers

ph38 shares personal data with third-party service providers who assist in operating the Platform — including KYC verification providers, payment processors (GCash, Maya, BPI, BDO, Metrobank, Visa, Mastercard), game software providers (PG Soft, Pragmatic Play, Jili, Evolution Gaming), cloud hosting providers, and fraud detection services. All service providers are contractually required to process data solely for the purposes defined by ph38 and to maintain appropriate security standards.

7.2 Regulatory & Law Enforcement Authorities

ph38 will disclose personal data to PAGCOR, the AMLC, the NPC, the Bureau of Internal Revenue (BIR), or any other competent Philippine authority where required by law, court order, or regulatory directive. ph38 will notify affected players of such disclosures where legally permitted to do so.

7.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets involving ph38, personal data may be transferred to a successor entity as part of that transaction, subject to equivalent privacy protections.

7.4 With Your Consent

ph38 may share your data with third parties in circumstances not covered above where you have provided explicit prior consent. You may withdraw such consent at any time.

8. Cookies & Tracking Technologies

ph38 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit the ph38 website.

8.1 Types of Cookies We Use

• Essential cookies: Required for the Platform to function. These cookies manage your login session, security tokens, and language preferences. Disabling them will prevent you from using the Platform.
• Analytics cookies: Used to collect aggregated, anonymized data about how players interact with the Platform, helping us identify performance issues and improve the user experience for Filipino mobile users.
• Functional cookies: Remember your preferences (e.g., game lobby filters, preferred payment method) to personalize your experience across sessions.
• Marketing cookies: Used only where you have consented to receiving personalized promotional content from ph38.

8.2 Managing Cookies

You can control cookie settings through your browser preferences. Note that disabling essential cookies will impair or prevent your use of the ph38 Platform. For analytics and marketing cookies, you may also update your preferences through your ph38 Account Settings.

9. Data Retention

ph38 retains your personal data for as long as your Account is active and for a period after Account closure as required by applicable Philippine law and PAGCOR regulations. Specific retention periods are as follows:

• Account and identity data: Retained for a minimum of five (5) years after Account closure, as required under AMLA regulations applicable to gaming operators.
• Financial transaction records: Retained for a minimum of five (5) years in compliance with AMLA and BIR record-keeping requirements.
• KYC documents: Retained for the duration of the Account and for five (5) years post-closure.
• Gaming activity logs: Retained for five (5) years or as otherwise directed by PAGCOR.
• Support communications: Retained for three (3) years for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of marketing activities plus three (3) years to demonstrate compliance.

When the applicable retention period expires, ph38 will securely delete or anonymize the relevant data. Where data cannot be deleted immediately due to technical constraints, it will be isolated from active processing.

10. Data Security

ph38 implements technical and organizational security measures appropriate to the risks involved in processing personal data, including:

• TLS/SSL encryption for all data transmitted between your device and the ph38 Platform
• AES-256 encryption for sensitive data at rest in our databases
• Role-based access controls limiting staff access to personal data on a need-to-know basis
• Multi-factor authentication required for all administrative access to production systems
• Regular penetration testing and security audits conducted by independent third parties
• Intrusion detection systems and 24/7 security monitoring of Platform infrastructure
• Data breach response procedures compliant with NPC notification requirements (72-hour notification where a breach is likely to result in significant harm)

Despite these measures, no internet-based platform can guarantee absolute security. We encourage players to use strong, unique passwords, enable two-factor authentication, and report any suspected unauthorized access to their Account immediately.

11. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph38:

• Right to be informed: The right to be told what personal data ph38 collects about you and how it is used — as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data ph38 holds about you, free of charge, once per calendar year.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. Some corrections may require re-verification of your identity.
• Right to erasure: The right to request deletion of your personal data, subject to legal and regulatory retention obligations. Data required for AMLA, PAGCOR, or BIR compliance cannot be deleted before mandatory retention periods expire.
• Right to data portability: The right to receive a copy of your personal data in a structured, machine-readable format where technically feasible.
• Right to object: The right to object to processing based on legitimate interest, including direct marketing. Objecting to essential processing required for Account operation may result in Account closure.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to complain: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe ph38 has not handled your personal data in accordance with applicable law.

To exercise any of the above rights, please contact ph38's Data Protection Officer via the channels listed in Section 16. We will respond to all verified requests within thirty (30) days of receipt.

12. Children's Privacy

The ph38 Platform is strictly restricted to individuals who are 21 years of age or older. ph38 does not knowingly collect personal data from individuals under the age of 21. If ph38 becomes aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated Account.

If you believe that ph38 has inadvertently collected personal data from someone under 21, please contact our support team immediately so we can investigate and take appropriate action.

13. Cross-Border Data Transfers

ph38 may transfer your personal data to third-party service providers located outside the Philippines, including game software providers, cloud hosting infrastructure, and fraud detection services. Such transfers occur only where:

• The recipient country has been assessed as providing an adequate level of data protection; or
• Appropriate contractual safeguards (such as data processing agreements containing standard contractual clauses) are in place to protect your data; or
• The transfer is necessary for the performance of the contract between you and ph38 (e.g., processing a deposit through an international card scheme).

All cross-border transfers are conducted in compliance with the NPC's requirements for cross-border data flows under the Data Privacy Act of 2012.

14. Third-Party Links

The ph38 Platform does not contain links to third-party websites for commercial or marketing purposes. Where links to third-party resources appear in a regulatory or informational context (such as references to PAGCOR's responsible gaming initiatives), ph38 is not responsible for the privacy practices of those external sites. This Privacy Policy applies solely to the ph38 Platform at ph38.cam.

15. Changes to This Privacy Policy

ph38 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, platform features, or applicable Philippine law. Material changes will be communicated to registered players via email notification or an in-platform notice at least seven (7) days before taking effect, where practicable.

The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the ph38 Platform after any changes to this Policy constitutes acceptance of the revised terms. We encourage you to review this Policy periodically.

16. Contact & Complaints

For questions, access requests, correction requests, or complaints regarding this Privacy Policy or ph38's handling of your personal data, please contact us through the following channels:

• Data Protection Officer — Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 on the ph38 Platform

ph38 will acknowledge all data privacy requests within 48 hours and provide a substantive response within 30 days. Where additional time is needed to process a complex request, we will inform you of the expected timeline.

If you are not satisfied with ph38's response to your privacy complaint, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. Information on filing a complaint with the NPC is available from the NPC directly.