phsuper Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected, processed, stored, and used by phsuper ("we", "us", "our") in connection with the operation of the phsuper online gaming platform accessible at phsuper.club (the "Platform"). It applies to all registered players, prospective players who browse the Platform, and any other individuals whose personal data we process in the course of providing our services to the Philippine market.

phsuper takes its obligations under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR) very seriously. This Policy is designed to help you, as a data subject, fully understand how your personal information is handled so you can make informed decisions about your use of the phsuper Platform.

By registering for a phsuper account or by continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood how phsuper processes your personal data as described in this document. Please read this Policy carefully. If you have any questions or concerns, our Data Protection Officer (DPO) can be reached at the details provided in Section 15.

The data controller responsible for the personal data processed through the phsuper Platform is the licensed Operator holding the PAGCOR online gaming licence under which phsuper operates. All data processing activities conducted by phsuper are carried out in accordance with the Operator's PAGCOR licence conditions and applicable Philippine data protection law.

For all data-related enquiries, rights requests, and complaints, the phsuper Data Protection Officer (DPO) may be contacted by email at [email protected] with the subject line "Data Privacy Request". Full contact details are provided in Section 15 of this Policy.

phsuper collects personal data across several categories depending on your relationship with the Platform and the stage of account lifecycle you are at. The table below outlines what we collect and why.

phsuper does not collect sensitive personal information beyond what is required for KYC and AML purposes (i.e., government ID data). We do not collect religious beliefs, political affiliations, health data unrelated to responsible gaming, or any other special categories of personal data.

phsuper collects personal data through the following methods:

• Information submitted during the phsuper account registration process, including your mobile number and password.
• KYC documents and verification materials submitted in response to phsuper's identity verification requests.
• Payment details entered when making deposits or requesting withdrawals via GCash, PayMaya, or bank transfer.
• Information shared with phsuper's customer support team through live chat or email communications.
• Responsible gaming preference settings configured within your phsuper account dashboard.

• Technical data including IP address, device identifiers, and browser information collected automatically when you access the phsuper Platform.
• Gaming activity data generated as a natural by-product of your use of phsuper's casino games, sportsbook, and other gaming products.
• Session data including login timestamps, logout timestamps, and platform navigation paths.
• Cookie and similar tracking technology data, as further described in Section 8 of this Policy.

• Transaction confirmation data received from payment providers including GCash, PayMaya, BDO, BPI, and Metrobank to confirm deposit and withdrawal status.
• Identity verification data from third-party KYC service providers engaged by phsuper to assist with document authentication.
• Fraud and AML screening results from compliance data providers used by phsuper to meet PAGCOR regulatory requirements.

phsuper uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, securing, and closing phsuper player accounts. This includes processing login credentials, managing sessions, and handling account recovery requests.
• Identity Verification (KYC): Verifying that players meet phsuper's 21+ age requirement and confirming the identity of players before large withdrawals, as required by PAGCOR and Philippine AML law.
• Payment Processing: Processing deposits from and withdrawals to GCash, PayMaya, and Philippine bank accounts. This requires sharing necessary payment data with the relevant payment service providers.
• Regulatory Compliance: Meeting phsuper's obligations under PAGCOR's licensing conditions, the Philippine Anti-Money Laundering Act (RA 9160 and amendments), and other applicable Philippine laws and regulations.
• Responsible Gaming: Monitoring gaming activity to identify potential problem gambling patterns, administering deposit limits and self-exclusion requests, and ensuring that age restrictions are enforced across the Platform.
• Customer Support: Responding to player enquiries, resolving account disputes, processing complaints, and delivering the support services documented in phsuper's Terms & Conditions.
• Fraud Prevention and Security: Detecting and preventing fraudulent account activity, unauthorised access, bonus abuse, money laundering, and any other misuse of the phsuper Platform.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the phsuper Platform's performance, game selection, user interface, and overall player experience.
• Legal Claims: Establishing, exercising, or defending legal claims related to phsuper's operation, including before PAGCOR, the National Privacy Commission, or Philippine courts.

Under the Philippine Data Privacy Act of 2012 and its IRR, phsuper relies on the following legal bases for processing personal data:

• Contractual Necessity: Processing required to perform the contract between phsuper and the Player (as defined in phsuper's Terms & Conditions), including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with phsuper's obligations under Philippine law — including PAGCOR licensing requirements, the Anti-Money Laundering Act, and the Data Privacy Act itself.
• Legitimate Interests: Processing carried out on the basis of phsuper's legitimate interests, where these interests are not overridden by the data subject's rights. This includes fraud prevention, security monitoring, and service improvement through anonymised analytics.
• Consent: Processing carried out with the Player's freely given, specific, informed consent — primarily in the context of direct marketing communications and optional preference tracking. Consent may be withdrawn at any time.

phsuper does not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

phsuper engages trusted third-party service providers who process personal data on our behalf, under strict data processing agreements that require them to maintain data security and use data only for the purpose for which it was shared. These include:

• Payment service providers (GCash/Maya Philippines, BDO Unibank, BPI, Metrobank) for transaction processing.
• KYC and identity verification service providers engaged to assist phsuper with document authentication.
• Cloud hosting providers and IT infrastructure suppliers who provide the servers and network infrastructure on which the phsuper Platform operates.
• Customer support platform providers whose software facilitates phsuper's live chat service.

phsuper is required to disclose personal data to Philippine regulatory and law enforcement authorities in the following circumstances:

• Upon lawful request or order from PAGCOR in connection with its regulatory oversight of phsuper's operations.
• Upon lawful request from the Anti-Money Laundering Council (AMLC) in connection with suspicious transaction reporting obligations under RA 9160.
• Upon lawful court order, subpoena, or other legally binding process issued by a Philippine court or competent authority.
• To the National Privacy Commission (NPC) in connection with any investigation, complaint, or audit relating to data privacy compliance.

phsuper's third-party game providers (such as JILI Games, Pragmatic Play, PG Soft, and Evolution Gaming) receive limited technical session data — including player session tokens and bet records — necessary to deliver game functionality. These providers do not receive personally identifiable information such as your full name, mobile number, or payment details.

phsuper uses cookies and similar tracking technologies to operate the Platform, maintain player sessions, and improve the user experience. A cookie is a small text file placed on your device by a website that your browser sends back to the website each time you visit.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling essential cookies may prevent you from accessing certain areas of the phsuper Platform, including your account dashboard. phsuper does not use advertising or tracking cookies that follow you across other websites.

phsuper retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account and KYC Data: Retained for the duration of the player's account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act.
• Transaction Records: Financial transaction records are retained for a minimum of five (5) years following each transaction date, as required by Philippine AML regulations and PAGCOR requirements.
• Gaming Activity Logs: Game history and session logs are retained for a minimum of three (3) years to support dispute resolution, responsible gaming monitoring, and regulatory audits.
• Customer Support Records: Live chat transcripts and email correspondence are retained for a period of two (2) years from the date of the interaction, or longer if related to an open dispute or regulatory investigation.
• Technical Logs: Server and security logs are retained for a maximum of twelve (12) months, after which they are permanently deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original data. Anonymised aggregate data (which cannot identify any individual) may be retained indefinitely for statistical and business intelligence purposes.

phsuper implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• TLS 1.3 Encryption: All data transmitted between your device and the phsuper Platform is encrypted using Transport Layer Security (TLS) version 1.3 — the current industry standard for securing data in transit, equivalent to the encryption used by Philippine banks.
• Password Hashing: Player passwords are stored using a strong one-way cryptographic hashing algorithm. phsuper staff cannot read your password; they can only validate it.
• Access Controls: Access to personal data is restricted to phsuper personnel who genuinely require it to perform their job functions. Access rights are reviewed regularly and revoked upon role change or departure.
• Two-Factor Authentication: SMS-based 2FA is available for all phsuper player accounts and is strongly recommended. Internal phsuper systems processing sensitive data require multi-factor authentication for all staff access.
• Security Monitoring: phsuper operates continuous security monitoring to detect unusual access patterns, potential account breaches, and fraudulent activity in real time.

Under the Philippine Data Privacy Act of 2012 and its IRR, every Filipino data subject — including all phsuper players — has the following rights with respect to their personal data. phsuper will respond to all rights requests within thirty (30) calendar days of receipt, at no charge to the data subject.

To exercise any of these rights, please contact phsuper's Data Protection Officer at [email protected] with the subject line "Data Privacy Request" and include your registered mobile number and the specific right you wish to exercise. phsuper may require identity verification before processing the request.

The phsuper Platform is strictly intended for adults aged 21 years and above in accordance with PAGCOR's minimum age requirement for online gaming in the Philippines. phsuper does not knowingly collect or process personal data from individuals under the age of 21.

If phsuper becomes aware that it has inadvertently collected personal data from a person under the age of 21, we will take immediate steps to delete that data from our systems and permanently close the associated account. Any deposits made by an underage player will be handled in accordance with phsuper's Terms & Conditions and PAGCOR's guidelines for underage gambling incidents.

If you are a parent or guardian and believe that your child under 21 has registered an account on phsuper, please contact us immediately at [email protected] with the subject line "Underage Account Report".

phsuper's primary data processing infrastructure is located within, or accessible from, the Philippines. However, some of phsuper's service providers — including cloud hosting and game provider partners — may process data outside the Philippines.

Where personal data is transferred outside the Philippines, phsuper ensures that appropriate safeguards are in place to protect that data in a manner consistent with the requirements of the Philippine Data Privacy Act. These safeguards include:

• Contractual data processing agreements that impose data protection standards equivalent to those required under Philippine law.
• Transfers only to countries or organisations that the National Privacy Commission recognises as providing adequate data protection.
• Technical and organisational measures to ensure that transferred data is handled securely and used only for the disclosed purpose.

phsuper does not transfer player data to any jurisdiction for the purpose of avoiding Philippine data protection requirements.

phsuper may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or PAGCOR regulatory requirements. The "Effective Date" at the top of this document will be updated whenever the Policy is revised.

Where an update to this Policy is material — meaning it significantly affects how we collect, use, or share your personal data, or it reduces your rights as a data subject — phsuper will provide advance notice to registered players via the mobile number or email address on file, at least fourteen (14) calendar days before the change takes effect.

Minor amendments, including corrections, clarifications, and updates required to reflect changes in Philippine law that do not reduce player rights, may be implemented without advance notice. Continued use of the phsuper Platform after an update to this Policy constitutes acceptance of the revised version.

For all data privacy enquiries, rights requests, and complaints related to phsuper's processing of your personal data, please contact our Data Protection Officer (DPO) through the following channels:

• Email: [email protected] — use the subject line "Data Privacy Request" for all DPA-related matters.
• Live Chat: Available 24/7 inside your phsuper account dashboard. Live chat is suitable for general data queries; formal rights requests should be submitted in writing via email for record-keeping purposes.
• Response Time: phsuper will acknowledge all data privacy requests within five (5) business days and will provide a substantive response within thirty (30) calendar days of receipt.

phsuper is committed to resolving all data privacy concerns fairly, promptly, and in full compliance with the Philippine Data Privacy Act. We value the trust that Filipino players place in us, and we take our responsibility as a data controller seriously.