Privacy Policy – How phkoy Protects Your Personal Data

1. Introduction

This Privacy Policy ("Policy") describes how phkoy ("phkoy," "we," "us," "our") collects, processes, stores, and protects the personal data of individuals ("you," "Player," "User") who register accounts on, or otherwise interact with, the phkoy online casino and sportsbook platform at phkoy.cam.

phkoy is committed to protecting the privacy and personal data of all Filipino players in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. Our data processing practices are further shaped by the requirements of the Philippine Amusement and Gaming Corporation ("PAGCOR") and the Anti-Money Laundering Act ("AMLA") as they apply to online gaming operators.

This Policy applies to all personal data collected through your use of phkoy, including registration, account management, deposits and withdrawals, gameplay, customer support interactions, and promotional participation. Please read this Policy carefully. If you have any questions about how phkoy handles your personal data, please contact our Data Protection Officer ("DPO") as described in Section 13.

2. Data Controller

phkoy acts as the personal information controller ("PIC") with respect to the personal data of its registered account holders and platform visitors, as defined under the Data Privacy Act of 2012. This means phkoy determines the purposes for which, and the means by which, your personal data is processed.

phkoy has appointed a Data Protection Officer responsible for overseeing compliance with this Policy and the Data Privacy Act. You may contact the DPO for any data privacy concerns using the contact details provided in Section 13 of this Policy.

In certain cases — such as where phkoy engages third-party game providers, payment processors, or technology vendors — those entities may act as personal information processors ("PIPs") processing data on behalf of phkoy under binding contractual obligations that require them to protect your personal data in accordance with Philippine law.

3. Personal Data We Collect

phkoy collects the following categories of personal data depending on the nature of your interaction with the platform:

3.1 Account Registration Data

• Full legal name (as appearing on a government-issued Philippine ID)
• Date of birth (used to verify 21+ age eligibility under PAGCOR rules)
• Philippine mobile number and email address
• Username and encrypted account password
• Preferred language and communication settings

3.2 Identity Verification (KYC) Data

• Government-issued ID documents (e.g., PhilSys National ID, UMID, SSS ID, driver's license, Philippine passport)
• Proof of address documentation (e.g., utility bill, barangay certificate)
• Selfie or facial verification image, where required for account verification
• Source-of-funds documentation for high-value transactions, as required under AMLA

3.3 Financial Transaction Data

• GCash account reference numbers, Maya wallet identifiers, or bank account details associated with your deposits and withdrawals
• Transaction amounts, timestamps, and reference codes for all PHP deposits and withdrawals
• Payment method type and associated account name (which must match your registered phkoy identity)

3.4 Gaming Activity Data

• Game session records including game type, duration, stakes, and outcomes
• Sports betting selections, wager amounts, and settlement records
• Bonus and promotion participation history
• Responsible gaming tool usage (deposit limits set, cool-off periods activated, self-exclusion requests)

3.5 Technical and Device Data

• IP address and approximate geographic location at login
• Device type, operating system, and browser version
• Session tokens, login timestamps, and access logs
• Cookie identifiers and analytics data (see Section 9)

3.6 Customer Support Data

• Contents of live chat, email, and any other support communications you initiate with phkoy
• Support ticket reference numbers and resolution records

4. How We Use Your Personal Data

phkoy processes your personal data for the following clearly defined purposes:

phkoy does not use your personal data for purposes unrelated to the operation of your phkoy account and our regulatory obligations without obtaining your separate, explicit consent.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, phkoy processes your personal data on one or more of the following lawful bases:

• Contractual necessity: Processing required to create and operate your phkoy account, process transactions, and deliver the gaming services you have requested.
• Legal obligation: Processing required for phkoy to comply with PAGCOR licensing conditions, AMLA obligations, NPC data registration requirements, and other applicable Philippine laws and regulations.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and system integrity where these interests are not overridden by your data privacy rights.
• Consent: For optional processing activities such as marketing communications, we will request your explicit, informed, and freely given consent and provide you with a straightforward mechanism to withdraw it at any time.

6. Data Sharing & Third-Party Disclosure

phkoy does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your personal data only in the following circumstances:

6.1 Regulatory and Legal Authorities

phkoy is required to share account and transaction data with PAGCOR as part of its operating license obligations. Additionally, phkoy may be required to report suspicious transactions to the Anti-Money Laundering Council (AMLC) under AMLA. phkoy will also disclose personal data in response to valid court orders, subpoenas, or lawful requests from Philippine law enforcement authorities.

6.2 Third-Party Service Providers (Personal Information Processors)

phkoy engages third-party vendors who process personal data on our behalf under binding data processing agreements. These include:

• Payment processors and e-wallet providers (GCash, Maya, BPI, BDO, etc.) solely for transaction processing
• KYC and identity verification service providers
• Game software providers who receive anonymized or necessary session data to deliver game content
• Cloud hosting and cybersecurity infrastructure providers
• Customer support platform providers

All third-party processors are bound by confidentiality obligations and are prohibited from using your personal data for any purpose beyond what phkoy has specifically authorized.

6.3 Business Transfers

In the event of a merger, acquisition, or transfer of substantially all of phkoy's assets, your personal data may be transferred as part of that transaction. phkoy will provide notice before your personal data becomes subject to a materially different privacy policy.

7. Data Retention

phkoy retains your personal data for as long as necessary to fulfill the purposes outlined in this Policy, subject to the following retention guidelines:

• Active account data: Retained for the full duration of your phkoy account's active status.
• KYC and identity verification records: Retained for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements applicable to covered persons in the Philippines.
• Financial transaction records: Retained for a minimum of five (5) years in compliance with AMLA and PAGCOR requirements.
• Gaming activity logs: Retained for a minimum of three (3) years for the purposes of responsible gaming monitoring, fraud investigation, and dispute resolution.
• Customer support records: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained for as long as you remain subscribed to marketing communications, plus one (1) year thereafter as evidence of consent.

Upon expiry of the applicable retention period, phkoy will securely delete or anonymize your personal data in accordance with NPC-recommended data disposal standards.

8. Security Measures

phkoy implements technical, organizational, and physical security measures designed to protect your personal data from unauthorized access, disclosure, alteration, loss, and destruction. These measures include:

• 256-bit Transport Layer Security (TLS) encryption for all data transmitted between your device and phkoy's servers
• AES-256 encryption at rest for stored sensitive personal data, including KYC documents and financial records
• Role-based access controls ensuring that only authorized phkoy personnel with a legitimate operational need can access personal data
• Optional two-factor authentication (2FA) for all phkoy account holders, strongly recommended for all users
• Session token rotation and automatic session expiry to reduce hijacking risk
• Regular penetration testing and vulnerability assessments of the phkoy platform infrastructure
• Internal data breach response procedures aligned with NPC breach notification requirements (72-hour notification obligation for high-risk breaches)

While phkoy takes all reasonable precautions to secure your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorized access to your phkoy account, contact our support team immediately.

9. Cookies & Tracking Technologies

phkoy uses cookies and similar tracking technologies to operate and improve the platform. The types of cookies phkoy uses are described below:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences, such as your preferred language and display settings, so you don't need to re-configure them on each visit.
• Analytics Cookies: Used to understand how players interact with the phkoy platform — which pages are visited most, how long sessions last, and where technical issues occur — so we can improve platform performance. Analytics data is aggregated and does not identify individual players.
• Responsible Gaming Cookies: Used to track session duration for the purposes of in-session time reminder notifications, consistent with your responsible gaming settings.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the phkoy platform. phkoy does not use cookies to serve third-party advertising on external websites.

10. Your Data Privacy Rights

Under the Data Privacy Act of 2012 and its Implementing Rules, you have the following rights with respect to your personal data held by phkoy:

• Right to be Informed: The right to be told what personal data phkoy collects, why it is collected, and how it is used — which this Policy fulfills.
• Right of Access: The right to request a copy of the personal data phkoy holds about you, including information on how it has been processed.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data in your phkoy account. For most account data, you may update it directly through Account Settings. KYC data corrections require submission of updated supporting documents.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. Note that certain data must be retained by phkoy to comply with AMLA and PAGCOR retention requirements, even after account closure.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Object: The right to object to certain processing activities, including direct marketing. You may unsubscribe from phkoy marketing communications at any time via your account communication preferences.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe phkoy has violated your data privacy rights under the Data Privacy Act.

To exercise any of the above rights, please contact phkoy's Data Protection Officer using the details in Section 13. phkoy will respond to all verifiable data subject requests within fifteen (15) calendar days of receipt, consistent with NPC guidelines.

11. Minors and the 21+ Policy

The phkoy platform is strictly intended for adults aged 21 years and above, in compliance with PAGCOR's minimum age requirements for online gaming in the Philippines. phkoy does not knowingly collect personal data from individuals under 21 years of age.

If phkoy discovers or is notified that a registered account belongs to an individual under the age of 21, the account will be immediately suspended, all associated personal data will be preserved only to the extent required for regulatory reporting, and the matter will be handled in accordance with PAGCOR guidelines. Any real-money balance held in an underage account will be managed per PAGCOR's prescribed process for such circumstances.

12. Changes to This Privacy Policy

phkoy reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements, or improvements to platform operations. The "Effective Date" at the top of this Policy indicates when the current version became applicable.

When material changes are made to this Policy, phkoy will notify registered account holders via their registered email address or through a prominent in-platform notification displayed upon their next login. We encourage you to review this Policy periodically even in the absence of notifications to stay informed about how phkoy protects your personal data.

Your continued use of the phkoy platform after any revision to this Policy is effective constitutes your acceptance of the updated terms. If you do not agree with any revised policy, you should contact phkoy to request account closure.

13. Contact Us & Data Protection Officer

For all data privacy inquiries, requests to exercise your data subject rights, or concerns about phkoy's data processing practices, please contact phkoy's designated Data Protection Officer. All communications relating to data privacy are handled with strict confidentiality.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you are dissatisfied with how phkoy has handled your personal data or responded to your data subject request.