phi99 Privacy Policy

1. Introduction

phi99 ("we", "us", "our") operates the online casino and sports betting platform accessible at phi99.net, including phi99 Casino, all game verticals, account management services, and related digital properties (collectively, the "phi99 Platform"). As a Philippines-focused online gaming operator, phi99 collects and processes the personal data of registered players and platform visitors in the course of providing its services.

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the relevant issuances of the National Privacy Commission (NPC) of the Philippines. phi99 is committed to ensuring that all personal data collected through the phi99 Platform is processed lawfully, fairly, and transparently, and is used only for the purposes described in this policy.

By registering a phi99 account or by continuing to use any part of the phi99 Platform, you acknowledge that you have read, understood, and consented to the collection and processing of your personal data as described in this Privacy Policy. If you do not agree to this policy, please do not create a phi99 account and discontinue use of the phi99 Platform.

2. Data Controller Identity

For the purposes of the Data Privacy Act of 2012 and its IRR, phi99 acts as the Personal Information Controller (PIC) in respect of all personal data collected through the phi99 Platform. phi99 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with the Data Privacy Act of 2012 and all applicable NPC regulations.

phi99 has designated a Data Protection Officer (DPO) who is responsible for overseeing data protection compliance across the phi99 Platform and for serving as the primary point of contact for data privacy inquiries and complaints. Contact details for the phi99 DPO are provided in Section 15 of this Privacy Policy.

3. Personal Data We Collect

phi99 collects the following categories of personal data from players and platform visitors, depending on the nature of your interaction with the phi99 Platform:

3.1 Identity & Contact Data

• Full legal name (first name, middle name, last name)
• Date of birth and age verification documentation
• Philippine residential address (barangay, city/municipality, province)
• Valid government-issued ID (e.g., PhilSys ID, SSS, GSIS, Passport, Driver's License, PRC ID)
• Email address
• Mobile number registered to a Philippine network (Globe, Smart, DITO, or equivalent)

3.2 Financial & Payment Data

• GCash or Maya account details (mobile number linked to the e-wallet)
• Bank account details for BPI, BDO, Metrobank, UnionBank, and other Philippine banks
• Cryptocurrency wallet addresses (for USDT TRC-20, USDT ERC-20, BTC, ETH, and other supported assets)
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment reference numbers
• Source of funds declarations where required for KYC compliance

3.3 Account & Gaming Activity Data

• phi99 account username and encrypted password
• Gaming history including games played, bets placed, amounts wagered, and outcomes across all phi99 game verticals
• Bonus and promotion claims and wagering progress
• Responsible gaming tool settings (deposit limits, self-exclusion status, session reminders)
• Customer support interaction records and correspondence

3.4 Technical & Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Session timestamps, login and logout records
• Pages visited, features used, and clickstream data within the phi99 Platform
• Cookies and similar tracking technology data (see Section 8)

4. How We Collect Your Data

phi99 collects personal data through the following means:

• Direct submission: Data you provide when registering your phi99 account, completing KYC verification, submitting a withdrawal request, contacting support, or updating your account profile.
• Automated collection: Technical and usage data collected automatically through cookies, server logs, and analytics tools when you access or interact with the phi99 Platform.
• Third-party verification: Identity and age verification data obtained from accredited KYC service providers and identity document verification platforms engaged by phi99.
• Payment processors: Transaction confirmation data received from GCash, Maya, Philippine banks (BPI, BDO, Metrobank), and cryptocurrency payment processors in connection with your deposits and withdrawal requests.
• Regulatory sources: Data received from PAGCOR, the NPC, law enforcement agencies, or other competent Philippine authorities pursuant to lawful regulatory or legal process.

5. Legal Basis for Processing

phi99 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to create and manage your phi99 account, process deposits and withdrawals, deliver gaming services, and fulfil phi99's obligations under the Terms & Conditions.
• Legitimate interests: Processing necessary for phi99's legitimate interests in preventing fraud, detecting cheating and bonus abuse, ensuring platform security, and improving phi99 services — provided these interests are not overridden by your data protection rights.
• Legal obligation: Processing required for phi99 to comply with applicable Philippine law, including the Anti-Money Laundering Act (AMLA), PAGCOR regulatory requirements, NPC obligations, and lawful orders from Philippine courts and government agencies.
• Consent: Where phi99 relies on your consent as the legal basis for processing (for example, for optional marketing communications), you may withdraw your consent at any time by contacting the phi99 DPO or updating your communication preferences in your account settings.

6. How We Use Your Personal Data

phi99 uses your personal data for the following specific purposes:

6.1 Account Management & Service Delivery

To create and maintain your phi99 account, verify your identity and age (21+ requirement), process deposits and withdrawals through your chosen payment method (GCash, Maya, BPI, BDO, Metrobank, crypto), deliver game services across all phi99 verticals, and provide customer support.

6.2 Regulatory & Legal Compliance

To fulfil phi99's obligations under the Data Privacy Act of 2012, the Anti-Money Laundering Act (AMLA) and its amendments, PAGCOR licensing conditions, and all other applicable Philippine laws and regulations. This includes conducting mandatory KYC checks, filing suspicious transaction reports (STRs) where required, and retaining transaction records for the legally mandated periods.

6.3 Responsible Gaming

To operate and enforce responsible gaming tools including deposit limits, self-exclusion, and session reminders; to monitor gaming behaviour for indicators of problem gambling; and to comply with any exclusion orders issued by PAGCOR or requested by the player or their authorised representative.

6.4 Fraud Prevention & Platform Security

To detect and prevent fraudulent activity, account takeover attempts, multi-accounting, bonus abuse, money laundering, and other prohibited conduct; to monitor IP addresses and device fingerprints for suspicious access patterns; and to protect the integrity of the phi99 Platform and the interests of all legitimate players.

6.5 Platform Improvement & Analytics

To analyse aggregated, anonymised usage data to improve the performance, features, and user experience of the phi99 Platform. phi99 does not use individually identifiable data for A/B testing or product analytics without a valid legal basis.

6.6 Marketing Communications

Where you have provided consent, to send you promotional offers, bonus notifications, and platform updates via email or SMS. You may opt out of marketing communications at any time by updating your preferences in your phi99 account settings or by contacting the phi99 DPO.

7. Data Sharing & Disclosure

phi99 may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC & Identity Verification Providers: Accredited third-party identity verification services engaged by phi99 to perform automated or assisted document verification and age checks as required for account registration and withdrawals.
• Payment Processors: GCash, Maya, Philippine banks (BPI, BDO, Metrobank, UnionBank), and cryptocurrency payment gateways, to the extent necessary to process your deposit or withdrawal transaction.
• Game Software Providers: Licensed game developers and providers whose titles are offered on the phi99 Platform, to the extent necessary for game session authentication and outcome recording.
• Fraud Prevention & Security Services: Third-party fraud detection and cybersecurity platforms engaged by phi99 to protect the platform and its players from fraudulent and malicious activity.
• Regulatory Authorities: PAGCOR, the NPC, the Anti-Money Laundering Council (AMLC), and other competent Philippine government agencies or law enforcement bodies, where disclosure is required by law, court order, or lawful regulatory directive.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by phi99, subject to binding professional confidentiality obligations.

8. Cookies & Tracking Technologies

The phi99 Platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised user experience. The following categories of cookies are used:

phi99 does not use third-party advertising cookies or behavioural tracking cookies for cross-site advertising purposes. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to log in to your phi99 account or use core platform features.

9. Data Retention

phi99 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account & Identity Data: Retained for a minimum of five (5) years from the date of account closure, as required under PAGCOR regulations and the Anti-Money Laundering Act of the Philippines.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of verification, as required by applicable Philippine law.
• Gaming Activity Logs: Retained for a minimum of two (2) years from the date of each recorded session, for audit, dispute resolution, and regulatory purposes.
• Customer Support Records: Retained for a minimum of two (2) years from the date of the last support interaction.
• Marketing Consent Records: Retained for the duration of the consented marketing relationship plus one (1) year following withdrawal of consent or account closure, whichever is later.

Upon expiry of the applicable retention period, phi99 will securely delete or anonymise your personal data in accordance with our data disposal procedures, unless a longer retention period is required by a specific legal obligation or ongoing regulatory inquiry.

10. Data Security

phi99 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: All personal data transmitted between your device and the phi99 Platform is protected using TLS 1.2 or higher encryption. Sensitive data at rest, including payment information and identity documents, is encrypted using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to phi99 personnel and authorised processors who have a legitimate need to access it in the performance of their duties. Access is governed by role-based permissions and is logged and audited.
• Password Security: Player account passwords are stored as salted cryptographic hashes. phi99 never stores passwords in plain text and will never ask you to share your password with a phi99 employee or support agent.
• Infrastructure Security: The phi99 Platform is hosted on secure, hardened infrastructure with regular vulnerability assessments, penetration testing, and security patch management.
• Incident Response: phi99 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, phi99 will notify the NPC and affected players in accordance with the timeframes prescribed by the Data Privacy Act of 2012 and NPC Circular No. 16-03.

11. Your Data Privacy Rights

Under the Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data held by phi99:

• Right to be Informed: The right to be informed of the fact that your personal data is being collected and processed, the purposes of processing, and your rights as a data subject — as fulfilled by this Privacy Policy.
• Right to Access: The right to request a copy of the personal data phi99 holds about you, including information about how it is being processed.
• Right to Rectification: The right to request correction of any inaccurate, incomplete, or outdated personal data phi99 holds about you.
• Right to Erasure or Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, where your consent has been withdrawn, or where processing is unlawful — subject to phi99's legal retention obligations under AMLA and PAGCOR regulations.
• Right to Object: The right to object to the processing of your personal data, particularly for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, where technically feasible and where processing is based on consent or contractual necessity.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission of the Philippines if you believe phi99 has processed your personal data in violation of the Data Privacy Act of 2012.

To exercise any of the above rights, please contact the phi99 Data Protection Officer using the contact details provided in Section 15. phi99 will respond to all verified data subject requests within fifteen (15) business days of receipt, in accordance with NPC guidelines.

12. Children & Minors

The phi99 Platform is strictly intended for individuals aged 21 years and above in accordance with PAGCOR regulations governing online gaming in the Philippines. phi99 does not knowingly collect, process, or store personal data from any person under the age of 21.

phi99 implements age-verification controls at the account registration stage and at the point of first withdrawal request to enforce this restriction. Any account found to belong to a person under the age of 21 will be immediately suspended and all associated personal data will be permanently deleted, along with any account balance, which will be handled in accordance with applicable law and PAGCOR requirements.

If you are a parent or guardian and you believe a minor under your care has accessed or attempted to register on the phi99 Platform, please contact the phi99 DPO immediately using the details in Section 15. phi99 will investigate and take appropriate action without delay.

13. Cross-Border Data Transfers

phi99 primarily processes and stores personal data within the Philippines. In certain circumstances, however, personal data may be transferred to, or accessed by, recipients located outside the Philippines — for example, where phi99 engages game software providers, fraud prevention services, or cloud infrastructure providers that operate internationally.

Where such cross-border transfers occur, phi99 ensures that an adequate level of data protection is maintained by implementing one or more of the following safeguards:

• Binding contractual clauses in data processing agreements that impose data protection obligations equivalent to those under the Data Privacy Act of 2012
• Transfers to jurisdictions that the NPC has recognised as providing an adequate level of data protection
• Obtaining your explicit consent to the transfer where required by the NPC

phi99 will not transfer your personal data to any jurisdiction or recipient that cannot guarantee an adequate standard of data protection consistent with the requirements of the Data Privacy Act of 2012 and applicable NPC issuances.

14. Updates to This Privacy Policy

phi99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. The "Last Updated" date at the top of this document will always indicate the date of the most recent revision.

Where changes to this Privacy Policy are material — for example, where phi99 introduces a new purpose for processing, a new category of data collection, or a new category of recipient — phi99 will notify registered players by email or via an in-platform notification prior to the changes taking effect.

Your continued use of the phi99 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgement of and agreement to the revised terms. If you do not agree to the updated Privacy Policy, you must discontinue use of the phi99 Platform and may request account closure in accordance with the phi99 Terms & Conditions.

15. Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or phi99's data processing practices, or if you wish to exercise any of your data subject rights under the Data Privacy Act of 2012, please contact the phi99 Data Protection Officer through the following channels:

• Email (DPO): [email protected] — please include "Data Privacy Request" in the subject line (plain text — not a clickable link; copy and paste into your email client)
• Live Chat: Available 24/7 via the phi99 Platform — request to be connected to the Data Protection team

phi99's DPO is based in the Philippines and is available during Philippine Standard Time (PST) business hours for scheduled consultations. For urgent data security concerns such as suspected unauthorised account access or data breach notifications, live chat is the recommended contact channel.

Players who are not satisfied with phi99's response to a data privacy concern may escalate their complaint to the National Privacy Commission of the Philippines through the NPC's official complaint filing process, details of which are available on the NPC's official government website.