Privacy Policy — 64ph

1.1 Scope. This Privacy Policy governs the collection, use, storage, disclosure, and protection of personal information processed by 64ph in connection with: (a) the registration and maintenance of player accounts on the 64ph platform; (b) the provision of casino games, sports betting, bingo, and all other gaming services available at 64ph.org; (c) financial transactions, including deposits via GCash, Maya, BPI, BDO, Metrobank, and other supported payment channels, and withdrawal processing; (d) promotional and marketing communications directed at registered 64ph players; and (e) customer support and dispute resolution activities.

1.2 Data Controller. 64ph is the data controller responsible for personal information collected and processed through the 64ph platform. As data controller, 64ph determines the purposes and means of processing your personal information and is accountable for ensuring that such processing complies with applicable Philippine data privacy law, principally the Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA") and its Implementing Rules and Regulations.

1.3 Applicable Law. The collection, use, storage, and disclosure of personal information by 64ph is governed by the Data Privacy Act of 2012 (Republic Act No. 10173) of the Republic of the Philippines, along with all implementing rules, circulars, and advisory opinions issued by the National Privacy Commission (NPC). To the extent that PAGCOR regulations impose additional data handling obligations on 64ph, those obligations are also incorporated into 64ph's data processing practices.

64ph collects the following categories of personal information from players and prospective players in connection with the operation of the platform:

2.1 Sensitive Personal Information. Government-issued identification documents uploaded for KYC purposes constitute sensitive personal information under the DPA. 64ph processes such information solely for the purpose of age verification, identity confirmation, and anti-money laundering compliance. Sensitive personal information is subject to heightened security controls within the 64ph platform.

2.2 Voluntary Provision. Certain information — such as an email address — is provided on a voluntary basis and is not required for account registration. Where data provision is optional, 64ph will indicate this at the point of collection.

64ph collects personal information through the following channels and methods:

• Direct registration: Information you provide when creating a 64ph account, including your name, mobile number, and date of birth.
• KYC verification: Government ID documents and selfie photographs submitted to complete identity verification prior to withdrawal enablement.
• Payment transactions: Financial data captured when you initiate a deposit or withdrawal through GCash, Maya, BPI, BDO, Metrobank, or other supported payment channels.
• Platform usage: Technical and behavioral data collected automatically as you interact with the 64ph website and its games, including through cookies and similar tracking technologies (see Section 10).
• Customer support interactions: Information you share when contacting 64ph's support team via live chat or other communication channels.
• Third-party payment processors: Confirmation and transaction data received from GCash, Maya, and partner banks when you initiate or complete a financial transaction linked to your 64ph account.
• Game providers: Game session and outcome data from 64ph's licensed game provider partners, used to record your wagering history and to support dispute resolution.

64ph uses the personal information it collects for the following purposes:

4.1 Platform Operations

To create and maintain your 64ph account; to authenticate your identity at login; to process deposits and withdrawals through GCash, Maya, and other supported payment channels; to deliver and record game sessions; to credit winnings and apply bonus funds to your wallet; and to provide 24/7 customer support in Tagalog and English.

4.2 Legal and Regulatory Compliance

To verify that you meet the 21+ age requirement mandated by PAGCOR regulations; to conduct Know Your Customer (KYC) checks required under Philippine anti-money laundering (AML) regulations; to detect, investigate, and report suspicious transactions as required under Republic Act No. 9160 (Anti-Money Laundering Act) and its amendments; and to respond to lawful requests from PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine regulatory and law enforcement authorities.

4.3 Security and Fraud Prevention

To detect and prevent unauthorized account access, identity fraud, bonus abuse, collusion, cheating, and other prohibited conduct; to monitor login activity for anomalous patterns; and to investigate account security incidents.

4.4 Responsible Gaming

To monitor player activity for behavioral patterns associated with problem gambling; to enforce voluntary limits set by players on deposits, losses, and session times; to process self-exclusion requests; and to apply responsible gaming interventions where warranted by account activity patterns.

4.5 Communications and Marketing

To send you account notifications, transaction confirmations, and security alerts via SMS to your registered Philippine mobile number; and — only where you have not opted out — to send promotional communications about 64ph bonuses, new games, and platform updates. You may opt out of marketing communications at any time by contacting 64ph support.

4.6 Platform Improvement

To analyze aggregate usage patterns, identify technical issues, and improve the performance, design, and feature set of the 64ph platform. Such analysis is conducted on aggregated or pseudonymized data wherever practicable.

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, 64ph processes your personal information on the following legal bases:

• Contractual necessity: Processing required to fulfill 64ph's obligations to you under the 64ph Terms & Conditions, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulations, AML obligations under Republic Act No. 9160, and data retention requirements.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gaming monitoring, where such interests are not overridden by your data subject rights.
• Consent: Processing for marketing communications and certain optional data uses, where 64ph has obtained your express or implied consent at the point of data collection. You may withdraw consent to marketing communications at any time without affecting the lawfulness of prior processing.

6.1 Third-Party Sharing. 64ph does not sell, rent, or trade your personal information to any third party. 64ph shares personal information only in the circumstances described below, and only to the extent necessary for each specified purpose.

6.2 Payment Processors. 64ph shares transaction data with GCash (operated by G-Xchange, Inc.), Maya (operated by PayMaya Philippines, Inc.), BPI, BDO, Metrobank, and other payment service providers involved in processing your deposit or withdrawal requests. Such sharing is limited to the data necessary to authenticate and complete the specific transaction.

6.3 Game Providers. 64ph shares relevant session and account data with licensed third-party game providers — including but not limited to PG Soft, Pragmatic Play, JILI, and Evolution Gaming — to the extent required for game delivery, fair play certification, and dispute resolution. Game providers are contractually required to process such data solely for these purposes.

6.4 Identity Verification Services. KYC document data may be shared with third-party identity verification service providers engaged by 64ph to assist with document authentication and age verification.

6.5 Regulatory Authorities. 64ph will disclose personal information to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other Philippine government agencies and law enforcement authorities where required by applicable law, court order, or lawful regulatory request.

6.6 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of all or part of 64ph's business, player personal information may be transferred to the acquiring entity, subject to that entity's assumption of equivalent privacy protections. Affected players will be notified of any such transfer where required by applicable law.

7.1 Cross-Border Processing. Some of 64ph's third-party game providers and technical service providers operate servers and processing infrastructure located outside the Philippines. Where personal information is transferred to or processed in jurisdictions outside the Philippines, 64ph ensures that appropriate safeguards are in place to protect the information in a manner consistent with the requirements of the Data Privacy Act of 2012.

7.2 Safeguards. International data transfers by 64ph are subject to contractual data processing agreements with the relevant third-party recipients that incorporate data protection obligations equivalent to those applicable under Philippine law. Where a receiving jurisdiction has been recognized by the National Privacy Commission as providing adequate data protection, no additional safeguards are required.

7.3 Limitation. 64ph does not transfer sensitive personal information — including government ID documents uploaded for KYC purposes — to servers located outside the Philippines except where strictly necessary for identity verification services and subject to the contractual safeguards described above.

8.1 Retention Period. 64ph retains personal information for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with Philippine AML record-keeping requirements under Republic Act No. 9160.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the relevant transaction, consistent with BSP and AMLC requirements applicable to covered persons.
• Gaming session records: Retained for a minimum of three (3) years from the date of each session, for dispute resolution and regulatory audit purposes.
• Customer support records: Retained for two (2) years from the date of the relevant interaction, unless related to an unresolved dispute or regulatory matter.
• Marketing communications data: Retained until you opt out of marketing communications, at which point your details are removed from active marketing lists. Records of opt-out requests are retained for compliance documentation purposes.

8.2 Post-Retention Deletion. Upon expiry of the applicable retention period, 64ph will securely delete or anonymize personal information unless continued retention is required by law or necessary for the resolution of an active legal or regulatory proceeding in which 64ph is involved.

9.1 Technical Safeguards. 64ph implements industry-standard technical measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include: SSL/TLS encryption of all data transmitted between player devices and the 64ph platform; encryption at rest for sensitive personal information stored in 64ph's databases; multi-factor authentication requirements for administrative access to systems containing personal information; and network security controls including firewalls, intrusion detection systems, and regular vulnerability assessments.

9.2 Organizational Safeguards. Access to personal information within 64ph is restricted on a need-to-know basis. 64ph employees and contractors who handle personal information are subject to confidentiality obligations and receive data privacy training. 64ph maintains a data privacy and security policy that is reviewed and updated periodically.

9.3 Breach Notification. In the event of a personal data breach that is likely to result in a real risk of serious harm to affected data subjects, 64ph will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required by the DPA and NPC Circular No. 16-03. Affected players will be notified without undue delay where the breach is likely to adversely affect their rights and freedoms.

9.4 Player Responsibility. Notwithstanding 64ph's security measures, you are responsible for maintaining the confidentiality of your 64ph account login credentials. 64ph recommends enabling two-factor authentication on your account and using a strong, unique password. Do not share your login details with any third party.

10.1 Use of Cookies. The 64ph platform uses cookies and similar client-side tracking technologies to support platform functionality and to collect behavioral and technical data as described in Section 2. Cookies are small text files stored on your device by your web browser.

10.2 Types of Cookies. 64ph uses the following categories of cookies:

• Strictly necessary cookies: Required for the 64ph platform to function, including session authentication tokens that keep you logged in to your account. These cookies cannot be disabled without impairing your use of the platform.
• Functional cookies: Store your preferences — such as language settings and responsible gaming limit configurations — so that they persist between sessions.
• Analytics cookies: Collect aggregated data about how players navigate and use the 64ph platform, allowing 64ph to identify performance issues and improve the user experience. This data is processed in aggregate and is not used to identify individual players.
• Security cookies: Support fraud detection and security monitoring functions, including detection of anomalous login patterns.

10.3 Cookie Management. You may manage cookie preferences through your browser's settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the 64ph platform. 64ph does not use third-party advertising or behavioral targeting cookies.

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal information processed by 64ph. To exercise any of these rights, contact 64ph's Data Protection Officer using the contact details provided in Section 14.

• Right to be Informed: The right to be informed of what personal information 64ph collects about you and how it is used, as described in this Privacy Policy.
• Right to Access: The right to obtain a copy of the personal information 64ph holds about you, along with information about how it is being processed.
• Right to Correction: The right to request correction of any inaccurate or incomplete personal information held about you by 64ph.
• Right to Erasure or Blocking: The right to request the deletion or blocking of personal information that is no longer necessary for the purpose for which it was collected, provided that no overriding legal retention obligation applies.
• Right to Object: The right to object to the processing of your personal information for direct marketing purposes. Upon receipt of an opt-out request, 64ph will cease sending marketing communications to you.
• Right to Data Portability: The right to receive a copy of the personal information you have provided to 64ph in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe that 64ph has failed to comply with its obligations under the Data Privacy Act of 2012. Information on lodging a complaint with the NPC is available on the NPC's official website.

64ph will respond to data subject rights requests within thirty (30) days of receipt. Where additional time is required to process a complex request, 64ph will notify you of the extended timeline within the initial thirty-day period.

12.1 Age Restriction. The 64ph platform is strictly restricted to individuals aged twenty-one (21) and above. 64ph does not knowingly collect personal information from persons under twenty-one (21) years of age. Age is verified through the KYC process prior to withdrawal enablement.

12.2 Underage Accounts. If 64ph becomes aware that personal information has been collected from a person under the age of twenty-one (21) — whether through registration, KYC review, or other means — 64ph will promptly close the relevant account, delete the collected personal information to the extent not required for regulatory reporting purposes, and, where applicable, report the matter to relevant authorities.

12.3 Parental Awareness. 64ph strongly advises registered players to ensure that their account credentials are inaccessible to minors who may share their household or device. If a parent or guardian becomes aware that a minor has accessed the 64ph platform using their account, they should contact 64ph support immediately to initiate an account review.

13.1 Right to Update. 64ph reserves the right to modify, update, or replace any part of this Privacy Policy at any time, consistent with changes in applicable Philippine law, NPC guidance, PAGCOR regulatory requirements, or 64ph's data processing practices.

13.2 Notification of Changes. Where a change to this Privacy Policy materially affects how 64ph processes your personal information or your rights as a data subject, 64ph will provide advance notice of the change via account notification, platform banner announcement, or SMS to your registered Philippine mobile number. Non-material changes — such as typographic corrections or clarifications that do not affect the substance of the policy — may be made without prior notice.

13.3 Continued Use. Your continued use of the 64ph platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated policy. If you do not agree with material changes to this Privacy Policy, you may request account closure in accordance with the procedure described in the 64ph Terms & Conditions.

The current version of this Privacy Policy, together with its effective date, is always available on this page.

14.1 Data Protection Officer. 64ph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO is the first point of contact for data subject rights requests, privacy complaints, and inquiries about 64ph's data processing practices.

14.2 Contacting the DPO. You may contact 64ph's Data Protection Officer through the following channel:

Live Chat (Preferred): Available 24/7 directly from your 64ph account dashboard. Identify your inquiry as a data privacy matter at the start of the chat and the support agent will escalate it to the DPO function within one (1) Philippine business day.

Email: [email protected] — Please include "Data Privacy Request" in your message subject. Allow up to five (5) Philippine business days for initial response via email.

14.3 NPC Complaints. If you are not satisfied with 64ph's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent regulatory body responsible for enforcing the Data Privacy Act of 2012 in the Philippines.