phl9 Privacy Policy

1 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Information" means any information, whether recorded in a material form or not, from which the identity of an individual can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual, as defined under the Philippine Data Privacy Act of 2012.
• "Sensitive Personal Information" means personal information about an individual's race, ethnic origin, marital status, age, colour, and religious, philosophical or political affiliations; health, education, genetic or sexual life; proceedings for any offence committed or alleged; and government-issued identification numbers.
• "Processing" refers to any operation or set of operations performed upon personal information — including collection, recording, organisation, storage, updating, retrieval, consultation, use, consolidation, blocking, erasure, or destruction.
• "Data Subject" means any natural person whose personal information is processed by phl9 — in this context, any registered phl9 player or platform visitor.
• "Personal Information Controller" (PIC) refers to phl9 as the entity that determines the purposes and means of processing personal information.
• "DPA" refers to the Philippine Data Privacy Act of 2012, Republic Act No. 10173, and its implementing rules and regulations.
• "NPC" refers to the National Privacy Commission of the Philippines, the supervisory body responsible for enforcing the DPA.
• "PAGCOR" refers to the Philippine Amusement and Gaming Corporation, the regulatory authority overseeing phl9's gaming operations.

2 Scope & Application

This Privacy Policy applies to all personal information collected by phl9 in connection with the operation of the phl9 gaming platform, accessible at phl9.net, and any associated mobile applications made available for download. It covers all registered players, prospective players who visit the platform, and individuals who contact phl9 customer support.

This Policy applies regardless of how you access the phl9 platform — whether via desktop browser, mobile browser, or the phl9 native mobile application. It applies to Filipino players located in the Philippines and to any other individuals who access the platform where permitted by applicable law.

This Privacy Policy should be read together with phl9's Terms and Conditions and Responsible Gaming Policy, all of which form part of the agreement between you and phl9. Where any provision of this Policy conflicts with the Terms and Conditions on a data privacy matter, this Privacy Policy shall prevail.

3 Data We Collect

phl9 collects personal information that is necessary, adequate, and not excessive in relation to the purposes for which it is collected and processed. The categories of personal information we collect are as follows:

4 How We Collect Your Data

phl9 collects your personal information through the following channels:

• Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in promotions, you directly provide us with personal information.
• Automated collection: When you use the phl9 platform, our systems automatically collect technical and device data including your IP address, session duration, pages visited, and in-game activity through server logs and first-party analytics tools.
• Cookie and local storage data: Cookies and similar technologies placed on your browser or device collect information about your browsing sessions, login state, and platform preferences. See Section 8 for full details on cookie usage.
• Third-party verification services: During KYC, phl9 may use authorised third-party identity verification providers to cross-check the documents you submit. These providers operate under strict data processing agreements with phl9.
• Payment processors: When you transact via GCash, Maya, BPI, BDO, Metrobank, UnionBank, or other approved payment channels, those processors share transaction confirmation data with phl9 to facilitate deposit and withdrawal processing.

5 How We Use Your Data

phl9 uses the personal information it collects only for lawful, specified purposes that are directly connected to operating a safe, compliant, and high-quality gaming platform for Filipino players. The specific purposes for which we process your data are:

phl9 will never use your personal data for purposes incompatible with those listed above. Where we wish to use your data for a new purpose, we will notify you and, where required under the DPA, seek your fresh consent before doing so.

6 Legal Basis for Processing

phl9 processes your personal information on the following legal grounds as recognised under the Philippine Data Privacy Act of 2012:

• Contractual necessity: Processing is necessary to perform our obligations under the Terms and Conditions you accepted when registering your phl9 account — including providing gaming services, processing payments, and delivering customer support.
• Legal obligation: Processing is required to comply with our legal and regulatory obligations, including PAGCOR licensing requirements, the Anti-Money Laundering Act (AMLA), and reporting duties under Philippine law.
• Legitimate interests: Processing is carried out for phl9's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving the quality of our services — provided these interests are not overridden by your rights and interests.
• Consent: For specific processing activities such as marketing communications and optional analytics participation, phl9 relies on your freely given, informed, and specific consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

phl9 does not sell, rent, or commercially trade your personal information to any third party. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Game providers: Certified game studios such as JILI, Pragmatic Play, Evolution Gaming, and PG Soft receive session and wagering data necessary to deliver their games and ensure fair outcomes. These providers are bound by data processing agreements with phl9.
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, UnionBank, and cryptocurrency processors receive the financial information required to execute your deposits and withdrawals. These entities operate under their own privacy frameworks and applicable Philippine financial regulations.
• KYC and identity verification providers: Authorised third-party verification services receive copies of identity documents submitted during KYC. All such providers are contractually required to process data only for verification purposes.
• PAGCOR and Philippine regulatory authorities: phl9 is obligated to report certain player activity and transaction data to PAGCOR and, where required by law, to the Anti-Money Laundering Council (AMLC) and other competent Philippine government authorities.
• Law enforcement and courts: phl9 may disclose personal information to Philippine law enforcement agencies, courts, or government bodies where required to do so by a valid legal order, subpoena, or applicable law.
• Corporate transactions: In the event of a merger, acquisition, or restructuring involving phl9, your data may be transferred to a successor entity, subject to the same privacy protections described in this Policy.

8 Cookies & Tracking Technologies

phl9 uses cookies and similar local storage technologies to operate, secure, and improve the platform. A cookie is a small text file placed on your device when you visit phl9.net. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the platform to function. These enable core services such as user authentication, session management, and security features. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and responsible gaming limit configurations to provide a personalised experience.
• Performance & Analytics Cookies: Collect anonymised data about how pages are used, which features are most visited, and how errors occur. This data helps phl9 improve platform performance for Filipino players.
• Security Cookies: Used to detect and prevent fraudulent login attempts, bot activity, and other malicious behaviour on the platform.

phl9 does not use third-party advertising or tracking cookies. You may manage cookie preferences through your browser settings, noting that disabling strictly necessary cookies will impair your ability to use the platform. A cookie consent banner is displayed on your first visit to phl9.net, giving you clear control over non-essential cookies.

9 Data Retention

phl9 retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

• Account and KYC records: Retained for a minimum of five (5) years from account closure, as required by Philippine AMLA regulations and PAGCOR record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with AMLA and Bureau of Internal Revenue (BIR) requirements.
• Gaming activity logs: Retained for three (3) years from the date of the relevant gaming session, unless a longer period is required for dispute resolution or regulatory purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction, unless the matter relates to an ongoing dispute, legal proceeding, or regulatory inquiry.
• Marketing consent records: Retained for as long as you maintain an active subscription to phl9 marketing communications, plus one (1) year after withdrawal of consent.
• Self-exclusion records: Retained permanently for players who have requested indefinite self-exclusion, to prevent future account creation in violation of the exclusion.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of your identity from the remaining data.

10 Data Security

phl9 employs comprehensive technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. Key security measures include:

• 256-bit TLS/SSL encryption on all data transmitted between your device and phl9 servers.
• AES-256 encryption at rest for all databases containing personal and financial information.
• Multi-factor authentication (MFA) available for all player accounts and mandated for all phl9 administrative staff accounts.
• Role-based access control (RBAC) ensuring that phl9 employees can only access personal data that is strictly necessary for their specific job function.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• 24/7 security monitoring of platform infrastructure for anomalous activity, intrusion attempts, and data breach indicators.
• Secure data centres with physical access controls, redundant power, and environmental safeguards.

In the event of a personal data breach that poses a real risk to your rights and freedoms, phl9 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under the DPA. Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights.

11 Your Data Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information held by phl9. These rights may be exercised by contacting our Data Protection Officer using the details in Section 15:

phl9 will respond to valid data rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further two (2) months, notifying you of the extension and reason within the initial 30-day window. Exercising your rights is free of charge; however, phl9 may charge a reasonable administrative fee for manifestly unfounded or excessive requests.

If you are unsatisfied with phl9's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

12 Minors & Age Verification

phl9 does not knowingly collect personal information from individuals under the age of 21. In compliance with PAGCOR regulations and Philippine law, the minimum legal gambling age on phl9 is 21 years old. Age verification is a mandatory component of the KYC process, and no real-money account will be activated without verified confirmation of minimum age.

13 International Data Transfers

phl9's primary data processing infrastructure is located within the Philippines. However, some of our third-party service providers — including certain game studios, cloud infrastructure providers, and KYC verification services — may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, phl9 ensures that appropriate safeguards are in place to protect your information in accordance with the DPA. These safeguards include contractual clauses requiring the recipient to apply equivalent data protection standards, and, where applicable, transfers to jurisdictions recognised by the NPC as providing adequate levels of data protection.

phl9 will not transfer your sensitive personal information outside the Philippines without your explicit consent, except where required by applicable law or PAGCOR regulation.

14 Changes to This Privacy Policy

phl9 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify registered players via email to the address on file and/or via a prominent notice on the phl9 platform.

The "Last Updated" date at the top of this Policy will be revised whenever changes are made. The most current version of this Privacy Policy will always be accessible at phl9.net/privacy-policy. It is your responsibility to review this page periodically. Continued use of the phl9 platform after any amendments constitutes your acceptance of the revised Policy.

If you do not agree with any change to this Privacy Policy, you must stop using the phl9 platform and may contact our Data Protection Officer to request account closure and deletion of your personal data, subject to applicable legal retention obligations.

15 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information by phl9, you may contact our designated Data Protection Officer (DPO) through the following channels:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data rights under the DPA have been violated. The NPC can be reached through their official government channels.