phplush Privacy Policy

1 Introduction

phplush ("phplush," "we," "us," or "our") is the operator of the online gaming platform accessible at phplush.co and any associated mobile applications. phplush operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is committed to protecting the privacy and personal data of every player who uses the platform.

This Privacy Policy ("Policy") describes how phplush collects, uses, stores, shares, and protects the personal information of users ("you," "Player," or "Data Subject") in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission of the Philippines ("NPC"). It also reflects phplush's obligations under its PAGCOR operating license, applicable anti-money laundering legislation, and other relevant Philippine laws.

By registering an account, accessing the phplush platform, or otherwise interacting with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2 Personal Data We Collect

phplush collects the following categories of personal data, depending on your interaction with the platform:

Category	Examples of Data Collected	When Collected
Identity Data	Full legal name, date of birth, government-issued ID number (for KYC)	Registration and KYC verification
Contact Data	Philippine mobile number, email address (if provided)	Registration and account management
Financial Data	GCash number, PayMaya number, bank account details (last 4 digits), transaction amounts	Deposits, withdrawals, KYC
Technical Data	IP address, device type, operating system, browser type, session tokens	Each platform access
Usage Data	Games played, bet amounts, session duration, bonus usage, login history	During active play
Communications Data	Live chat transcripts, support ticket content, in-app messages	When you contact support
Verification Data	Copies of government-issued IDs, selfie photos (for KYC)	First withdrawal verification

3 How We Collect Your Data

phplush collects personal data through the following means:

• Direct Collection: Information you actively provide during account registration, KYC verification, deposit and withdrawal requests, support interactions, and promotional opt-ins.
• Automated Collection: Technical and usage data collected automatically through cookies, server logs, session tracking, and mobile application analytics as you navigate and interact with the phplush platform.
• Third-Party Sources: Identity verification data received from third-party KYC service providers or Philippine government verification systems used to confirm the authenticity of documents you submit.
• Payment Processors: Transaction confirmation data from GCash, PayMaya, banks, and card networks used to reconcile your account balance and comply with financial reporting obligations.

4 Purposes of Processing

phplush processes your personal data for the following specific purposes:

• Creating and maintaining your phplush player account;
• Verifying your identity and age (21+) as required by PAGCOR and the DPA;
• Processing deposits, withdrawals, and internal fund transfers on the phplush platform;
• Detecting, preventing, and investigating fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct;
• Complying with anti-money laundering obligations under Republic Act No. 9160 (Anti-Money Laundering Act), as amended, including filing required reports to the Anti-Money Laundering Council (AMLC);
• Providing customer support in English and Tagalog through live chat and other support channels;
• Administering bonuses, promotions, loyalty programs, and VIP rewards;
• Sending transactional notifications (deposit confirmations, withdrawal processing updates, account security alerts);
• Sending promotional communications where you have provided consent or where permitted by applicable law;
• Implementing and monitoring responsible gaming tools, including deposit limits and self-exclusion;
• Improving the phplush platform, including game performance, user interface optimization, and fraud pattern analysis;
• Complying with PAGCOR reporting requirements and any other applicable regulatory obligations.

5 Legal Basis for Processing

phplush processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing required to perform the phplush Player Agreement (Terms and Conditions), including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR regulatory requirements, AML obligations, and NPC directives.
• Legitimate Interest: Processing necessary for phplush's legitimate interests in fraud prevention, platform security, and service improvement, where such interests are not overridden by your rights.
• Consent: Processing for direct marketing communications and certain non-essential cookies, where you have provided clear, specific, and informed consent. Consent may be withdrawn at any time by contacting phplush support.

6 Data Sharing and Disclosure

phplush does not sell your personal data to third parties. phplush may share your personal data with the following categories of recipients:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard, and DragonPay, solely for the purpose of processing your financial transactions.
• KYC / Identity Verification Providers: Third-party services engaged to verify the authenticity of identity documents submitted during account verification.
• Game Software Providers: JILI, PG Soft, Pragmatic Play, and other game studios may receive anonymized gameplay data for game performance and RTP auditing purposes.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine government bodies, where disclosure is required by law, court order, or regulatory directive.
• Fraud Prevention Services: Third-party fraud detection platforms that analyze transaction patterns to protect phplush players and the platform from financial crime.
• Cloud Infrastructure Providers: Hosting and database service providers that process data on behalf of phplush under data processing agreements that include appropriate data protection obligations.

7 Cookies and Tracking Technologies

phplush uses cookies and similar tracking technologies on its website and mobile platform for the following purposes:

• Strictly Necessary Cookies: Required for core platform functionality including authentication, session management, and security features. These cannot be disabled without breaking the platform.
• Performance Cookies: Anonymous analytics data used to understand how players navigate the phplush platform, which games are most popular, and where technical issues occur.
• Functional Cookies: Used to remember your preferences, such as language settings and game view configurations.
• Marketing Cookies: Used only where you have provided consent, to deliver relevant promotional content. These may be disabled through your account settings or browser controls.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to play games on phplush, but may limit some personalization features.

8 Data Retention

phplush retains personal data for the following periods:

• Active Account Data: Retained for the duration of your phplush account and for a period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and Philippine AML obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by Republic Act No. 9160 and PAGCOR directives.
• KYC Documentation: Retained for five (5) years following account closure or the completion of the transaction for which verification was required.
• Support Communications: Retained for two (2) years from the date of the support interaction.
• Technical and Usage Logs: Retained for up to twelve (12) months for security and fraud analysis purposes, after which they are anonymized or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized, unless continued retention is required by applicable law.

9 Data Security

phplush implements organizational and technical security measures designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phplush platform;
• Encryption at rest for databases containing sensitive personal information and financial data;
• Role-based access controls limiting internal access to personal data to authorized personnel with a documented need;
• Multi-factor authentication for phplush administrative systems;
• Regular security audits and penetration testing by qualified third-party security professionals;
• Incident response procedures aligned with NPC breach notification requirements under the DPA.

10 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phplush:

• Right to Be Informed: The right to know that your personal data is being collected and processed, including the purposes and legal bases for processing — which this Policy fulfills.
• Right to Access: The right to request a copy of the personal data phplush holds about you and information about how it is processed.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data. Some data (such as your registered name) may require document submission for correction.
• Right to Erasure / Right to Be Forgotten: The right to request deletion of your personal data where processing is no longer necessary, where consent has been withdrawn, or where data has been unlawfully processed — subject to phplush's legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Object: The right to object to processing based on legitimate interest, including direct marketing. Upon receipt of a valid objection, phplush will cease the relevant processing unless compelling legitimate grounds exist.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission of the Philippines if you believe phplush has violated your data privacy rights.

To exercise any of these rights, please contact phplush's Data Protection Officer (DPO) through the live chat in your account dashboard or by emailing [email protected]. phplush will respond to verified data subject requests within fifteen (15) business days.

11 Children's Privacy and Age Restriction

The phplush platform is strictly for use by persons aged 21 years and above, as required by PAGCOR regulations. phplush does not knowingly collect personal data from individuals below the age of 21. If phplush discovers that personal data has been collected from an underage individual, such data will be immediately deleted and the associated account closed. Any deposits made by underage players will be returned through the original payment method where possible.

If you have reason to believe that a person under the age of 21 has registered on phplush, please notify us immediately through the support channels listed in Section 15.

12 International Data Transfers

Some of the third-party service providers engaged by phplush — including cloud infrastructure providers, game software vendors, and fraud prevention platforms — may be located or operate servers outside the Philippines. Where phplush transfers personal data internationally, it ensures that appropriate safeguards are in place in accordance with Section 21 of the Data Privacy Act and NPC guidelines on cross-border data transfers, including contractual clauses requiring the recipient to apply data protection standards at least equivalent to those required under Philippine law.

13 Third-Party Links

The phplush platform may contain links to third-party game providers' help pages or to PAGCOR's official information resources. phplush is not responsible for the privacy practices or content of any third-party website or application. Once you leave the phplush platform, this Privacy Policy no longer applies, and you should review the privacy policy of the relevant third party.

14 Updates to This Privacy Policy

phplush may update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, or phplush's data processing practices. When material updates are made, phplush will notify registered players by in-platform notification or SMS to the mobile number on file at least seven (7) days prior to the effective date of the change.

The most current version of this Privacy Policy will always be available at phplush.co/privacy-policy. Your continued use of the phplush platform after the effective date of any update constitutes your acknowledgment of the revised Policy.

15 Contact Us and Data Protection Officer

phplush has designated a Data Protection Officer ("DPO") as required under the Data Privacy Act of 2012. For any data privacy questions, requests to exercise your data subject rights, or concerns about how phplush handles your personal data, please contact:

• Data Protection Officer, phplush
• Email: [email protected] — please mark the subject line "Data Privacy Request"
• Live Chat: Available 24/7 via your phplush account dashboard (fastest response)
• Response Time: Within 15 business days for formal data subject requests; 3–5 minutes average for live chat inquiries

If you are not satisfied with phplush's response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph.