ph997 Privacy Policy —
How We Protect Your Personal Data

1.1 ph997 is committed to protecting the privacy and personal data of all users who register for and use the ph997 online gaming platform. This Privacy Policy sets out in detail how ph997 collects, processes, stores, shares, and protects personal data, and how you can exercise your rights under applicable Philippine data protection law.

1.2 This Policy applies to all personal data processed by ph997 in connection with: the registration and management of ph997 player accounts; the provision of gaming services including bingo, slots, live casino, sports betting, sabong, color game, and Joker Poker; payment and transaction processing; customer support interactions; and marketing and promotional communications (where consented to).

1.3 This Policy applies to all registered and prospective users of ph997 who are located in or accessing the Service from the Philippines, and to all personal data collected by ph997 through the ph997.cam website and any associated Progressive Web App (PWA).

1.4 ph997 acts as the Personal Information Controller (PIC) in respect of the personal data described in this Policy, as that term is defined under the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

2.1 ph997 collects the following categories of personal data from or about you:

2.2 ph997 does not intentionally collect sensitive personal information as defined under the Data Privacy Act (such as health or medical data, political opinions, or religious beliefs) unless such information is directly relevant to a regulatory compliance obligation — for example, health information provided in connection with a responsible gaming self-exclusion request.

3.1 Directly from You. The majority of personal data ph997 holds is provided directly by you, including during account registration, KYC identity verification, deposit and withdrawal requests, customer support communications, and promotional opt-in processes.

3.2 Automatically. When you access and use the ph997 platform, certain technical data is collected automatically through standard web server logs, session management systems, and cookies. This includes your IP address, browser fingerprint, device identifiers, login event timestamps, and page interaction data.

3.3 From Third Parties. ph997 may receive personal data about you from authorised third parties in limited circumstances, including:

• Payment service providers (GCash, Maya, BPI, BDO, Metrobank, GrabPay) for the purpose of confirming payment transactions;
• Identity verification service providers used in the KYC process;
• PAGCOR and other regulatory bodies, where information sharing is required by law;
• Fraud detection and anti-money laundering screening providers.

4.1 ph997 processes your personal data only where a lawful basis for processing exists under the Data Privacy Act of 2012. ph997 processes your personal data for the following purposes and on the following legal bases:

• Performance of Contract: To create and manage your ph997 account, process deposits and withdrawals, deliver gaming services, operate the VIP loyalty program, and fulfil our contractual obligations to you under the ph997 Terms & Conditions.
• Legal Obligation: To comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, BSP e-money regulations, and any other applicable Philippine laws or regulatory directions received by ph997.
• Legitimate Interests: To protect the security and integrity of the ph997 platform; to detect and prevent fraud, bonus abuse, and money laundering; to improve platform performance and user experience; and to manage ph997's business operations.
• Consent: To send you marketing communications, promotional offers, and newsletters — but only where you have specifically opted in to receive them. You may withdraw your consent at any time through your account settings or by contacting ph997 support.

4.2 ph997 does not use your personal data for automated decision-making that produces legal or similarly significant effects, except where such processing is required for AML screening or fraud detection, in which case you have the right to request human review of any automated decision that affects your account.

5.1 ph997 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Personal data is shared with third parties only in the following circumstances and to the extent strictly necessary:

• Payment Processors: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and 7-Eleven CLiQQ receive transactional data necessary to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable BSP regulations.
• KYC and Identity Verification Providers: ph997 uses licensed third-party identity verification services to assist with KYC compliance. These providers process identity document data under strict contractual confidentiality obligations.
• Regulatory Authorities: ph997 is required to disclose certain player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine regulatory bodies when directed or required by law.
• IT and Platform Service Providers: ph997 uses contracted third-party providers for data hosting, cloud infrastructure, cybersecurity, and customer support software. These providers act as Personal Information Processors (PIPs) under the Data Privacy Act and are bound by data processing agreements.
• Law Enforcement: ph997 may disclose personal data to the Philippine National Police (PNP), National Bureau of Investigation (NBI), or courts of competent jurisdiction in response to lawful requests, subpoenas, or court orders.

5.2 All third-party service providers and PIPs with whom ph997 shares personal data are required to maintain appropriate technical and organisational security measures and to process data only in accordance with ph997's documented instructions.

6.1 ph997 uses cookies and similar tracking technologies on the ph997.cam website and PWA to enable core platform functionality, maintain your login session, remember your preferences, and analyse aggregate platform usage patterns.

6.2 ph997 uses the following types of cookies:

• Essential Cookies: Required for the platform to function correctly. These include session management cookies that keep you logged in, security tokens, and load balancing cookies. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, game lobby filters, and responsible gaming limit displays. These improve your experience but are not strictly essential.
• Analytics Cookies: Used to collect anonymised or aggregated data about how users interact with the ph997 platform, to help ph997 improve site performance, identify technical issues, and optimise the gaming experience.
• Security Cookies: Used to support fraud detection, bot prevention, and session anomaly detection systems that protect your account.

6.3 You may control non-essential cookies through your browser settings. Note that disabling cookies may affect the functionality of certain ph997 features. ph997 does not use third-party advertising cookies or cross-site tracking technologies for the purpose of behavioural advertising.

7.1 ph997 implements and maintains appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• TLS 1.3 encryption on all data in transit between your device and ph997 servers;
• AES-256 encryption for sensitive data at rest;
• Cryptographic hashing with salting for all stored passwords;
• Multi-factor authentication (MFA/2FA) options for player accounts;
• Role-based access controls limiting internal access to personal data on a need-to-know basis;
• Regular third-party penetration testing and vulnerability assessments;
• Location-based anomaly detection and automated account lockout on repeated failed login attempts;
• Secure deletion protocols for personal data that has reached the end of its retention period.

7.2 Notwithstanding the security measures ph997 employs, no internet-based system can be guaranteed to be completely secure. ph997 is not liable for security breaches that arise from factors outside its reasonable control. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their ph997 accounts.

8.1 ph997 retains your personal data for as long as your ph997 account remains active or as necessary to fulfil the purposes described in this Privacy Policy. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required under PAGCOR licensing conditions and AMLA record-keeping obligations.
• Transaction and Financial Data: Retained for a minimum of five (5) years following the date of each transaction, in compliance with AMLA and BIR requirements.
• Gaming Activity Data: Retained for the duration of your account and for three (3) years following account closure, unless longer retention is required for a specific regulatory purpose.
• Customer Support Records: Retained for three (3) years from the date of each interaction.
• Marketing and Preference Data: Retained until you withdraw your consent or close your account, whichever occurs first.

8.2 Where personal data is no longer required for any legitimate retention purpose, ph997 will securely delete, anonymise, or pseudonymise the data in accordance with industry-standard secure deletion practices.

9.1 Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights with respect to your personal data held by ph997:

• Right to Be Informed: The right to know whether ph997 holds personal data about you, the source of that data, and how it is being used.
• Right of Access: The right to obtain a copy of the personal data ph997 holds about you, upon written request. ph997 will respond to access requests within fifteen (15) days of receipt.
• Right to Rectification: The right to request that inaccurate or incomplete personal data be corrected. You may update most of your account information directly through your ph997 account settings.
• Right to Erasure or Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purpose for which it was collected, or where processing is otherwise unlawful. Note that ph997 may be required to retain certain data under regulatory obligations notwithstanding an erasure request.
• Right to Object: The right to object to the processing of your personal data on grounds relating to your particular situation, including the right to opt out of direct marketing communications at any time.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to have that data transmitted to another personal information controller where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe ph997 has violated your data privacy rights.

9.2 To exercise any of the above rights, please contact ph997's Data Protection Officer (DPO) at the contact details provided in Section 13 of this Policy. ph997 will respond to all legitimate data subject rights requests within the timeframes prescribed by the Data Privacy Act.

10.1 The ph997 platform is strictly for adults who are twenty-one (21) years of age or older in the Philippines. ph997 does not knowingly collect personal data from persons under the age of 21.

10.2 If ph997 becomes aware that personal data has been collected from a person under 21 years of age — whether through misrepresentation during registration or by any other means — ph997 will promptly close the relevant account, delete all associated personal data, and refund any deposits made to the extent required by applicable law.

10.3 If you are a parent or guardian and believe that a minor under your care may have registered an account on ph997, please contact ph997's customer support immediately so that the account can be identified and closed.

11.1 ph997 primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data outside the Philippines — for example, to cloud infrastructure providers or game software licensors — ph997 ensures that appropriate safeguards are in place, including contractual clauses that require the recipient to protect the data in accordance with standards equivalent to those required under the Data Privacy Act.

11.2 ph997 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate additional safeguards.

11.3 Any cross-border transfers of personal data by ph997 are conducted in compliance with Section 21 of the Data Privacy Act and the applicable implementing rules and regulations issued by the National Privacy Commission.

12.1 ph997 reserves the right to amend this Privacy Policy at any time. Changes may be made to reflect updates to applicable Philippine law or NPC regulations, changes in ph997's data processing practices, or improvements to our privacy framework.

12.2 ph997 will provide reasonable notice of material changes to this Privacy Policy by posting a prominent notice on the ph997.cam website and, where appropriate, by sending a notification to your registered email address. The updated Policy will take effect on the date specified in the notice.

12.3 Your continued use of ph997 following the effective date of any amended Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree to the amended Privacy Policy, you must cease using the Service and may close your account in accordance with ph997's Terms & Conditions.

12.4 The most current version of this Privacy Policy will always be accessible on the ph997.cam website at the /privacy-policy URL. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.

13.1 ph997 has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012 and NPC Circular No. 16-01. The DPO is responsible for overseeing ph997's data protection compliance and can be contacted for all privacy-related enquiries, data subject rights requests, and data breach notifications.

13.2 To contact ph997's Data Protection Officer or to submit a data subject rights request, please use the following contact details:

• DPO Email: [email protected] (Subject line: "Data Privacy Request — [Your Account Username]")
• Live Chat: Available 24/7 on ph997.cam — request transfer to the Privacy & Data team
• Response Time: ph997 aims to acknowledge all privacy enquiries within 3 business days and to respond fully within 15 calendar days, as required under the Data Privacy Act

13.3 If you are not satisfied with ph997's response to your privacy request or complaint, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent regulatory body responsible for enforcing the Data Privacy Act in the Philippines.