phfan Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how phfan ("phfan", "we", "us", "our"), the operator of the online gaming platform at phfan.app, collects, processes, stores, and protects the personal information of users ("User", "Player", "you") who access or use the phfan Platform, including all associated subdomains, mobile interfaces, and related services.

phfan is committed to protecting your personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. We are also guided by PAGCOR's data governance requirements applicable to licensed online gaming operators.

By registering an account or using the phfan Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy.

2. Data Controller

phfan is the personal information controller ("PIC") as defined under the Data Privacy Act of 2012. As PIC, phfan determines the purposes and means of processing your personal data collected through the Platform.

phfan has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data privacy laws. You may contact the DPO at any time using the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

phfan collects the following categories of personal data:

phfan does not intentionally collect sensitive personal information beyond what is required for identity verification, age verification, and regulatory compliance. We do not collect biometric data beyond liveness checks required for KYC, and we do not collect health information except where voluntarily disclosed in the context of responsible gaming self-exclusion requests.

4. How We Collect Your Data

phfan collects personal data through the following means:

• Direct Registration: Information you provide when creating your phfan account, completing KYC verification, or updating your profile.
• Platform Usage: Data generated automatically as you use the phfan Platform, including gameplay activity, transaction records, and session logs.
• Payment Processors: Transaction confirmation data received from GCash, Maya, and partner banks when you make deposits or withdrawals.
• Cookies & Tracking Technologies: Automatically collected technical data via cookies, web beacons, and similar technologies as described in Section 10.
• Customer Support: Information you provide when contacting phfan via live chat, email, or other support channels.
• Third-Party Verification Services: Identity and age verification data from KYC service providers engaged by phfan for regulatory compliance.

5. How We Use Your Personal Data

phfan processes your personal data for the following purposes:

• Account Management: To create, maintain, and manage your phfan account, including authentication and security.
• Identity & Age Verification: To verify that you meet the 21+ age requirement and to comply with PAGCOR KYC obligations.
• Transaction Processing: To process deposits, withdrawals, and bonus credits accurately and securely.
• Regulatory Compliance: To comply with PAGCOR licensing requirements, anti-money laundering (AML) obligations under RA 9160, and NPC data privacy requirements.
• Responsible Gaming: To monitor gaming patterns, enforce self-exclusion requests, and provide responsible gaming tools and interventions where appropriate.
• Customer Support: To respond to your inquiries, resolve disputes, and improve our support services.
• Platform Improvement: To analyze usage patterns, troubleshoot technical issues, and enhance the phfan Platform experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — only where you have provided consent and subject to your communication preferences.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorized access, and other security threats.

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, phfan processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the phfan Terms & Conditions, including account management and transaction processing.
• Legal Obligation: Processing required to comply with PAGCOR regulations, AML laws, tax obligations, and NPC requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, and service improvement, where such interests are not overridden by your data privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit consent.

7. Data Sharing & Third Parties

phfan does not sell your personal data to third parties. We may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• PAGCOR and Regulatory Authorities: As required by our gaming licence and applicable Philippine law, including mandatory reporting of suspicious transactions to the Anti-Money Laundering Council (AMLC).
• KYC & Identity Verification Providers: Third-party service providers engaged to perform identity verification and age checks on phfan's behalf.
• Payment Processors: GCash, Maya, and partner banks, to the extent necessary to process your financial transactions.
• Game Providers: Licensed third-party game providers may receive anonymized or pseudonymized session data for game integrity and RTP auditing purposes.
• IT & Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers operating under strict data processing agreements.
• Legal & Professional Advisors: Lawyers, auditors, and compliance consultants where necessary for legal proceedings or regulatory audits.

All third-party processors engaged by phfan are required to implement appropriate technical and organizational security measures and to process personal data only on phfan's documented instructions.

8. Data Retention

phfan retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

• Active Account Data: Retained for the duration of your phfan account and for a minimum of five (5) years following account closure, as required by PAGCOR and AML regulations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Transaction Records:Retained for a minimum of five (5) years in accordance with Philippine tax and AML regulations.
• Marketing Data: Retained until you withdraw consent or request deletion, subject to any overriding legal retention obligations.
• Technical & Log Data: Retained for up to twelve (12) months for security and fraud prevention purposes.

Upon expiry of the applicable retention period, phfan will securely delete or anonymize your personal data in accordance with NPC-approved disposal procedures.

9. Data Security

phfan implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security measures include:

• Encryption: All data transmitted between your device and the phfan Platform is encrypted using TLS 1.2 or higher. Sensitive data at rest, including financial information and KYC documents, is encrypted using AES-256.
• Access Controls: Access to personal data is restricted to authorized phfan personnel and third-party processors on a strict need-to-know basis, enforced through role-based access controls.
• Two-Factor Authentication (2FA): phfan offers 2FA for player accounts to provide an additional layer of login security.
• Regular Security Audits: phfan conducts periodic vulnerability assessments and penetration testing of its Platform infrastructure.
• Incident Response: phfan maintains a data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, phfan will notify the NPC and affected Users within the timeframes prescribed by the Data Privacy Act.

10. Cookies & Tracking Technologies

phfan uses cookies and similar tracking technologies to operate and improve the Platform. The following types of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function, including session management and security tokens. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming limits.
• Analytics Cookies: Collect anonymized data about how players use the Platform to help us improve performance and user experience. Used only with your consent.
• Marketing Cookies: Used to deliver relevant promotional content. Used only with your explicit consent.

You can manage your cookie preferences through the cookie consent banner displayed on your first visit to the phfan Platform, or by adjusting your browser settings. Note that disabling certain cookies may affect Platform functionality.

11. Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phfan:

• Right to Be Informed: The right to know what personal data phfan collects and how it is processed — as set out in this Policy.
• Right of Access: The right to request a copy of the personal data phfan holds about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data, subject to overriding legal retention obligations (e.g., AML and PAGCOR requirements).
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of the above rights, please contact the phfan Data Protection Officer using the contact details in Section 14. phfan will respond to all verified data subject requests within fifteen (15) business days of receipt.

12. Minors & Age Restriction

The phfan Platform is strictly intended for persons aged 21 years and above, in accordance with PAGCOR regulations governing online gaming in the Philippines. phfan does not knowingly collect personal data from individuals under the age of 21.

If phfan becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on the phfan Platform, please contact us immediately via the details in Section 14.

13. Changes to This Privacy Policy

phfan reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform features. When material changes are made, phfan will notify registered Users via email or an in-platform notification at least seven (7) days before the changes take effect, where practicable.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the phfan Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

14. Contact Our Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights, please contact the phfan Data Protection Officer:

• Email (DPO): [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 via the phfan Platform in Filipino & English
• Response Time: Within fifteen (15) business days for formal data subject requests

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you are not satisfied with phfan's response to your data privacy concern.