phlagu Privacy Policy – How We Protect Your Personal Data

1 Who We Are (Data Controller)

phlagu ("phlagu," "we," "us," or "our") is the operator of the online gaming platform accessible at https://phlagu.org. For the purposes of the Data Privacy Act of 2012 (R.A. 10173), phlagu acts as the Personal Information Controller in respect of personal data collected from Filipino players and visitors to the phlagu website.

phlagu is a PAGCOR-regulated gaming operator serving players within the Republic of the Philippines. Our platform offers online casino games, slots, live dealer tables, bingo, and sports betting — all conducted in Philippine Peso (PHP) with payment support for GCash, PayMaya, BPI, BDO, and Metrobank.

Questions about this Privacy Policy or our data practices may be directed to our Data Protection Officer (DPO) using the contact details in Section 13 of this document.

2 Personal Data We Collect

phlagu collects personal data from you through various points of interaction with the platform. The categories of personal data we collect include:

Registration & Identity Data:

• Full legal name as it appears on a Philippine government-issued ID
• Date of birth and age verification information
• Registered email address
• Active Philippine mobile number
• Residential address within the Philippines
• Username and encrypted password

KYC Verification Data:

• Copies of government-issued Philippine ID (UMID, PhilHealth, driver's license, passport, SSS ID)
• Proof of address documents where requested
• Selfie or facial verification images where required

Financial Data:

• GCash account number or PayMaya account details
• Bank account details for BPI, BDO, or Metrobank transfers
• Transaction history (deposits, withdrawals, game wagers)

Technical & Usage Data:

• IP address and geolocation data
• Device type, operating system, and browser information
• Login timestamps and session duration
• Pages visited, games played, and clickstream data
• Cookie identifiers (see Section 6)

Communications Data:

• Records of support interactions (chat, email)
• Preferences and marketing consent status

phlagu does not collect sensitive personal information (as defined under R.A. 10173) unless it is specifically required for age verification, responsible gaming compliance, or PAGCOR regulatory obligations — in which case explicit consent is obtained.

3 How We Use Your Personal Data

phlagu uses the personal data collected from Filipino players for the following purposes:

• Account creation and management: Registering your phlagu account, verifying your identity, and managing your phlagu login credentials.
• Service delivery: Operating the gaming platform, processing deposits and withdrawals in PHP, awarding bonuses, and delivering the games and services you request.
• KYC and regulatory compliance: Conducting identity verification as required by PAGCOR and the Anti-Money Laundering Act (AMLA). Reporting to the Anti-Money Laundering Council (AMLC) where legally required.
• Responsible gaming: Monitoring for signs of problem gambling behavior, enforcing deposit limits, processing self-exclusion requests, and complying with the 21+ age restriction under PAGCOR regulations.
• Security and fraud prevention: Detecting and preventing unauthorized access to phlagu accounts, investigating suspicious transactions, and protecting the integrity of the platform.
• Customer support: Responding to your inquiries, resolving disputes, and providing assistance with account access (including phlagu login recovery).
• Platform improvement: Analyzing aggregated usage data to improve phlagu's games, features, and user experience for Filipino players.
• Marketing communications: Sending promotional offers, bonus notifications, and news about phlagu — only where you have provided valid consent and have not subsequently opted out.

4 Legal Basis for Processing

phlagu processes your personal data under the following legal bases as provided under the Data Privacy Act of 2012 (R.A. 10173):

• Consent: Where you have given specific, freely given, informed, and unambiguous consent to processing — for example, for marketing communications or voluntary data sharing beyond what is operationally required.
• Contractual necessity: Where processing is necessary to perform our contract with you — i.e., to operate your phlagu account, execute deposits and withdrawals, and deliver the gaming services you have subscribed to.
• Legal obligation: Where processing is required to comply with applicable Philippine law, including PAGCOR licensing conditions, AMLA requirements, NPC obligations, and court orders.
• Legitimate interests: Where processing is necessary for phlagu's legitimate business interests — such as fraud detection, platform security, and improvement of services — provided those interests are not overridden by your privacy rights.

Where phlagu relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5 Sharing Your Personal Data

phlagu does not sell or rent your personal data to third parties. We may share your personal data with the following categories of recipients, only to the extent necessary and subject to data protection obligations:

• Payment processors: GCash (Mynt), PayMaya (Voyager Innovations), BPI, BDO, Metrobank — for processing deposits and withdrawals to and from your phlagu account.
• Game content providers: Licensed game studios (e.g., JILI, Pragmatic Play, PG Soft) whose games are hosted on the phlagu platform. These providers may receive anonymized session data necessary for game operation and RNG certification.
• Identity verification and KYC service providers: Third-party KYC vendors who assist in verifying the identity and age of phlagu registrants in compliance with PAGCOR requirements.
• Regulatory and law enforcement authorities: PAGCOR, AMLC, the National Privacy Commission, and other competent Philippine government authorities where disclosure is required by law, court order, or regulatory direction.
• IT infrastructure and hosting providers: Cloud hosting, database, and security service providers operating under contractual data processing agreements with phlagu.
• Professional advisers: Legal, audit, and compliance advisers where access to personal data is necessary and subject to professional confidentiality obligations.

All third parties with whom phlagu shares personal data are required by contract to implement appropriate technical and organizational measures to protect the data and to use it only for the specified purpose.

6 Cookies & Tracking Technologies

phlagu uses cookies and similar tracking technologies on the phlagu website to improve the user experience and gather analytics data. The types of cookies used include:

• Strictly necessary cookies: Required for the phlagu platform to function correctly — including session authentication, phlagu login state management, and security controls. These cannot be disabled.
• Analytics cookies: Used to understand how Filipino players interact with phlagu — which pages are visited most, how long sessions last, and where errors occur — in order to improve the platform.
• Functional cookies: Used to remember your preferences, such as language settings and game display options, to personalize your phlagu experience.
• Marketing cookies: Used only where you have provided consent, to deliver relevant promotional content about phlagu's games and offers.

You may control cookie settings through your browser. Disabling strictly necessary cookies may impair the functionality of the phlagu platform, including the phlagu login process. Disabling analytics or marketing cookies will not affect your ability to access phlagu's games.

7 Data Retention

phlagu retains personal data for as long as your phlagu account remains active and for such further period as is required by applicable law or legitimate business need. Specific retention periods include:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required under AMLA and related regulations.
• KYC documents: Retained for the duration of your phlagu account and for five (5) years following account closure or last transaction.
• Support and communication records: Retained for three (3) years from the date of the interaction.
• Marketing preference and consent records: Retained until you withdraw consent and for three (3) years thereafter as evidence of your consent status.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be attributed to you.

8 Data Security

phlagu implements a comprehensive set of technical and organizational security measures to protect the personal data of Filipino players against unauthorized access, disclosure, alteration, or destruction. Key security controls include:

• 256-bit SSL/TLS encryption for all data in transit across phlagu's platform
• Encryption of sensitive data fields (including passwords and payment details) at rest using industry-standard algorithms
• Two-factor authentication (2FA) available for all phlagu accounts via OTP to a registered Philippine mobile number
• Role-based access controls ensuring that phlagu staff can only access personal data relevant to their specific job function
• Regular penetration testing and vulnerability assessments by independent security specialists
• Incident response procedures with mandatory notification to the NPC within 72 hours in the event of a personal data breach that poses a real risk to data subjects
• Staff training on data protection and privacy obligations under R.A. 10173

While phlagu takes all reasonable measures to protect your data, no online platform can guarantee absolute security. In the event of a data breach that is likely to adversely affect you, phlagu will notify you in accordance with our obligations under the Data Privacy Act.

9 Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (R.A. 10173), you have the following rights in relation to your personal data held by phlagu:

• Right to be informed: The right to know whether phlagu is processing your personal data and to receive clear information about how and why it is being used — which this Privacy Policy provides.
• Right of access: The right to request a copy of the personal data phlagu holds about you, including the categories of data, sources, and purposes of processing.
• Right to rectification: The right to have inaccurate or incomplete personal data corrected. You may update certain personal details directly through your phlagu account settings; for other updates, please contact support.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent — subject to phlagu's legal retention obligations under PAGCOR regulations and AMLA.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes at any time, with immediate effect. You may also object to other forms of processing on grounds relating to your particular situation.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another service provider where technically feasible.
• Right to lodge a complaint: The right to submit a complaint to the National Privacy Commission (NPC) if you believe that phlagu has processed your personal data in violation of R.A. 10173.

To exercise any of these rights, contact phlagu's Data Protection Officer using the details in Section 13. phlagu will respond to all verified data subject requests within thirty (30) days of receipt.

10 Children and Minors

phlagu's services are strictly available to persons who are 21 years of age or older, as required by PAGCOR regulations. phlagu does not knowingly collect personal data from individuals under the age of 21. All phlagu accounts are subject to age verification during the KYC process.

If phlagu discovers that personal data has been collected from a person under the age of 21 — whether through misrepresentation during registration or any other means — phlagu will immediately terminate the account, forfeit any balance in accordance with its Terms and Conditions, and delete the personal data associated with the account as promptly as legally permissible.

If you are a parent or guardian and believe that a minor has accessed phlagu's platform using your or another person's credentials, please contact phlagu's support team immediately at [email protected].

11 Cross-Border Data Transfers

phlagu primarily stores and processes personal data within data centers located in Southeast Asia. In certain circumstances — for example, where phlagu uses game content providers or technical infrastructure providers based in other countries — your personal data may be transferred to and processed in jurisdictions outside the Philippines.

Where such transfers occur, phlagu ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under Philippine law, including:

• Contractual data protection clauses binding recipient organizations to NPC-equivalent standards
• Transfer to jurisdictions that the NPC has recognized as providing adequate data protection
• Implementation of additional technical measures where the receiving jurisdiction's legal framework does not provide equivalent protections

12 Updates to This Privacy Policy

phlagu may update this Privacy Policy from time to time to reflect changes in our data practices, new service offerings, or changes in applicable Philippine law. Material changes will be communicated to registered phlagu players via the email address on file at least fourteen (14) days before the changes take effect, or through a prominent notice on the phlagu website.

Continued use of phlagu's services following notification of a material change constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you should cease using phlagu's services and may close your account in accordance with our Terms and Conditions.

The version date at the top of this page reflects the most recent update. phlagu recommends reviewing this page periodically to stay informed of how your personal data is handled.

13 Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by phlagu, please contact our Data Protection Officer:

• Data Protection Officer — phlagu
• Email: [email protected] — please use the subject line "Privacy / DPO Inquiry"
• Response time: phlagu aims to acknowledge all DPO inquiries within 48 hours and to resolve data subject requests within 30 calendar days.

If you are not satisfied with phlagu's response to your privacy inquiry, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which may be contacted through the NPC's official channels.

This Privacy Policy was last reviewed and updated in June 2026 and is effective from that date for all phlagu accounts and users in the Philippines.