php36 Privacy Policy — How We Handle Your Personal Data

1. Introduction

1.1 This Privacy Policy ("Policy") describes how php36 ("php36", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to users ("Player", "User", "you") of the php36 platform accessible at https://php36.org (the "Platform").

1.2 This Policy forms part of and must be read together with the php36 Terms and Conditions. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1.3 php36 is committed to upholding the rights of data subjects under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), and all implementing rules and regulations issued by the National Privacy Commission ("NPC") of the Republic of the Philippines.

2. Data Controller

2.1 For the purposes of this Policy and the Data Privacy Act of 2012, php36 acts as the personal information controller in respect of the personal data of players registered on the Platform.

2.2 php36 has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Policy. Data subjects may contact the DPO for any privacy-related inquiries using the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 php36 collects personal data in the following categories:

• Registration data: Full name, date of birth, email address, username, and password (stored as a salted hash — never in plain text);
• Identity verification (KYC) data: Government-issued ID (e.g., PhilSys, passport, driver's licence), selfie or live photo, proof of address (e.g., utility bill, bank statement), and tax identification number where required;
• Financial data: GCash/Maya account number, bank account details (BPI, BDO, Metrobank), transaction records, deposit and withdrawal history;
• Gaming data: Bet history, game session logs, wagering patterns, balance history, and bonus utilization records;
• Device and technical data: IP address, device type, operating system, browser type, geolocation (city/region level), session timestamps, and cookies;
• Communications data: Records of support interactions, email correspondence, and live chat transcripts.

3.2 We do not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance. Where sensitive information is required (e.g., government ID), it is processed solely for KYC and anti-money laundering purposes.

4. How We Use Your Personal Data

4.1 php36 uses your personal data for the following purposes:

• Creating and maintaining your player account and verifying your identity;
• Processing deposits, withdrawals, and other financial transactions in Philippine Peso;
• Complying with PAGCOR licensing requirements, anti-money laundering obligations, and other applicable laws;
• Providing customer support and resolving disputes;
• Administering promotions, bonuses, and loyalty programs you participate in;
• Monitoring platform usage for fraud prevention, security purposes, and responsible gaming compliance;
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts);
• Sending promotional communications where you have opted in to receive them — you may opt out at any time;
• Improving the Platform through aggregate, anonymized analytics.

5. Legal Basis for Processing

5.1 php36 processes personal data on the following legal bases as recognized under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform the contract between php36 and the player (e.g., account creation, payment processing, game delivery);
• Legal obligation: Processing required to comply with PAGCOR regulations, AMLC reporting obligations, NPC requirements, and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, platform security, and aggregate analytics, where such interests are not overridden by your data protection rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have provided freely given, specific, and informed consent.

6. Data Sharing and Disclosure

6.1 php36 does not sell your personal data. We may share your data with the following categories of parties in the circumstances described:

• Regulatory authorities: PAGCOR, AMLC, NPC, and other Philippine government agencies where required by law, court order, or regulatory directive;
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, Visa, and Mastercard, to the extent necessary to process your transactions;
• KYC/AML service providers: Third-party identity verification and fraud screening services that assist php36 in meeting its compliance obligations;
• IT infrastructure providers: Cloud hosting, database, and security vendors operating under strict data processing agreements and bound by equivalent data protection standards;
• Game providers: Certified game studios and live casino operators whose games are integrated into the php36 Platform — these providers receive only the minimum data required to deliver game services.

6.2 All third-party processors engaged by php36 are required to process personal data only in accordance with php36's instructions and are contractually bound to implement appropriate security measures.

7. Cookies and Tracking Technologies

7.1 php36 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function — including session authentication, load balancing, and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences, language settings, and login state to improve your experience.
• Analytics cookies: Collect aggregate, anonymized data on Platform usage to help us understand player behaviour and improve the product.

7.2 You may manage cookie preferences through your browser settings. Disabling non-essential cookies may affect Platform functionality. php36 does not use third-party advertising or tracking cookies that send your data to external advertising networks.

8. Data Retention

8.1 php36 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Account data and transaction records are retained for a minimum of five (5) years following account closure, in compliance with PAGCOR licensing requirements and AMLC record-keeping obligations;
• KYC documentation is retained for the period required by applicable AML regulations, typically five (5) years from the end of the business relationship;
• Support communications are retained for three (3) years for dispute resolution purposes;
• Marketing consent records are retained for the duration of the consent plus three (3) years thereafter.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC guidelines.

9. Your Rights as a Data Subject

9.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by php36:

• Right to be informed: To know that php36 is processing your personal data and the purposes for which it is processed;
• Right of access: To obtain a copy of the personal data php36 holds about you;
• Right to rectification: To have inaccurate or incomplete personal data corrected;
• Right to erasure: To request deletion of your personal data, subject to php36's legal retention obligations;
• Right to object: To object to processing of your personal data on grounds of legitimate interests or for direct marketing purposes;
• Right to data portability: To receive your personal data in a structured, commonly used format;
• Right to file a complaint: To lodge a complaint with the National Privacy Commission if you believe your data protection rights have been violated.

9.2 To exercise any of the above rights, contact the php36 Data Protection Officer using the details in Section 14. php36 will respond to valid requests within thirty (30) days, subject to identity verification requirements.

10. Children's Privacy

10.1 php36 is strictly an adult platform. We do not knowingly collect personal data from individuals under 21 years of age. The Platform is not directed at or designed for use by minors.

10.2 If php36 becomes aware that personal data has been collected from an individual under 21, we will take immediate steps to delete such data and close the associated account. If you believe a minor has registered on php36, please contact our support team immediately.

11. Cross-Border Data Transfers

11.1 In the course of providing services, php36 may transfer your personal data to service providers located outside the Philippines — for example, cloud infrastructure providers or game studios operating internationally.

11.2 All cross-border transfers of personal data are subject to the requirements of the Data Privacy Act of 2012 and NPC implementing rules. php36 ensures that recipient parties provide an adequate level of data protection through contractual safeguards, including NPC-approved standard contractual clauses where applicable.

12. Security Measures

12.1 php36 implements the following technical and organizational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data transmitted between your device and php36 servers;
• Encryption of sensitive data fields (passwords, payment details) at rest using industry-standard algorithms;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular internal and third-party security audits and vulnerability assessments;
• Multi-factor authentication for all administrative access to systems processing personal data;
• Documented incident response procedures including breach notification protocols.

12.2 Notwithstanding the above measures, no data transmission over the internet or electronic storage system is completely secure. php36 cannot guarantee absolute security but is committed to promptly addressing any security incidents in accordance with NPC requirements.

13. Amendments to This Policy

13.1 php36 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR requirements. The "Last Updated" date at the top of this page will be revised accordingly.

13.2 Material changes to this Policy will be communicated by prominent notice on the Platform or by email to your registered address at least seven (7) days before the changes take effect. Continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Policy.

14. Contact & Complaints

14.1 For any questions, concerns, or requests relating to this Privacy Policy or php36's data processing practices, please contact our Data Protection Officer. Our support email is displayed in the footer of this page.

14.2 If you are not satisfied with php36's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC's contact details and complaint procedures are available on the NPC's official website.

14.3 php36 takes all privacy complaints seriously and will acknowledge your inquiry within five (5) business days, with a substantive response within thirty (30) days unless additional time is required due to the complexity of the matter.