ph26 Privacy Policy

1. About This Policy

This Privacy Policy ("Policy") is published by ph26 ("ph26," "we," "us," "our"), the operator of the online gaming platform at ph26.asia. It describes how ph26 processes the personal data of individuals ("you," "Data Subject") who register for and use ph26 services, browse the ph26 website, or interact with ph26 through its support channels.

ph26 acts as the Personal Information Controller (PIC) in respect of all personal data collected through the ph26 platform. As PIC, ph26 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission of the Philippines.

By registering a ph26 account or using any ph26 service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must not create a ph26 account or use ph26 services.

2. Personal Data We Collect

ph26 collects personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy. The categories of personal data ph26 collects include:

ph26 does not collect special categories of personal data (e.g., health data, biometric data, racial or ethnic origin) unless strictly required for regulatory compliance and with your explicit consent.

3. How We Collect Your Data

ph26 collects personal data through the following means:

• Direct submission: When you register for a ph26 account, complete KYC verification, make a deposit or withdrawal, contact ph26 support, or participate in promotions, you provide personal data directly to ph26.
• Automated collection: When you access the ph26 website or platform, ph26's servers automatically collect Technical Data (IP address, device and browser information, session data) through server logs and, where applicable, cookies and similar technologies (see Section 7).
• Payment service providers: When you transact via GCash, Maya, or other accepted payment methods, ph26 receives confirmation of transaction status and masked payment account identifiers from those service providers.
• Regulatory and verification services: ph26 may verify identity information against government databases or use third-party KYC verification providers acting as Personal Information Processors under contractual data processing agreements.

4. Legal Basis for Processing

ph26 processes your personal data on the following legal bases as recognised under the Data Privacy Act of 2012:

• Contractual necessity: Processing is necessary to perform the ph26 service contract — including account management, deposits and withdrawals, gameplay, and customer support.
• Legal obligation: Processing is required to comply with PAGCOR regulations, Philippine anti-money laundering law (RA 9160 as amended), and National Privacy Commission requirements, including KYC and transaction reporting obligations.
• Consent: For marketing communications and optional data uses not strictly necessary for service delivery, ph26 relies on your freely given, specific, informed consent, which may be withdrawn at any time.
• Legitimate interests: ph26 may process data on the basis of its legitimate interests (e.g., fraud prevention, platform security, and responsible gaming enforcement) where those interests are not overridden by your fundamental rights and freedoms.

5. How We Use Your Personal Data

ph26 uses your personal data for the following purposes:

• Creating and managing your ph26 account, including login authentication and session management;
• Processing deposits and withdrawals through GCash, Maya, BPI, BDO, Metrobank, and other accepted Philippine payment methods;
• Conducting KYC and age verification in compliance with PAGCOR requirements — all players must be 21 years or older;
• Complying with anti-money laundering reporting obligations under RA 9160 and PAGCOR directives;
• Administering bonuses, promotions, and loyalty programmes;
• Operating responsible gaming tools, including deposit limits, self-exclusion, and underage access prevention;
• Providing 24/7 customer support via live chat and email ([email protected]);
• Detecting and preventing fraud, unauthorised access, cheating, and platform abuse;
• Improving the ph26 platform through aggregated and anonymised analytics;
• Sending service-related communications (account alerts, transaction confirmations, security notifications) and, with your consent, marketing communications about ph26 offers.

ph26 does not use automated decision-making that produces legal or similarly significant effects on you without human review, except where required for regulatory fraud-screening obligations.

6. Sharing of Personal Data

ph26 does not sell, rent, or trade your personal data to third parties for their independent commercial use. ph26 shares personal data only in the following circumstances:

6.1 Service Providers (Personal Information Processors)

ph26 engages third-party companies to perform functions on its behalf, including payment processing, identity verification, cloud hosting, customer support infrastructure, and fraud detection. These parties process your personal data solely on ph26's instructions under contractual data processing agreements that impose equivalent data protection obligations.

6.2 Regulatory and Legal Disclosure

ph26 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement agencies, or courts when required to do so by law, court order, or regulatory directive. ph26 will inform you of such disclosures where legally permissible to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a material portion of ph26's assets, personal data held by ph26 may be transferred to the successor entity. ph26 will notify affected users and ensure continuity of data protection obligations in any such transaction.

7. Cookies & Tracking Technologies

The ph26 website uses cookies and similar tracking technologies to ensure the platform functions correctly and to improve user experience. The categories of cookies used by ph26 are:

• Strictly necessary cookies: Required for core platform functionality including login session management and security. These cannot be disabled without affecting platform usability.
• Performance cookies: Collect anonymised data about how players use the ph26 platform (e.g., pages visited, errors encountered) to help ph26 improve its services. No personally identifiable information is stored in performance cookies.
• Functional cookies: Remember your preferences (e.g., language settings, responsible gaming tool configurations) to improve your ph26 experience.

ph26 does not use advertising or behavioural tracking cookies that share your data with third-party advertising networks. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect the functionality of the ph26 platform.

8. Data Retention

ph26 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Active account data: Retained for the duration of your ph26 account and for five (5) years following account closure, as required under PAGCOR anti-money laundering recordkeeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of transaction, consistent with AMLC recordkeeping obligations under RA 9160.
• KYC documents: Retained for five (5) years following account closure or the last transaction, whichever is later.
• Support communications: Retained for three (3) years from the date of the communication, or longer if related to an open dispute or legal proceeding.
• Technical and session logs: Retained for twelve (12) months for operational and security purposes, then purged or anonymised.

Upon expiry of the applicable retention period, ph26 will securely delete or anonymise your personal data in accordance with NPC-recognised disposal procedures.

9. Data Security

ph26 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between your device and ph26 servers is encrypted using TLS 1.3.
• Encryption at rest: Personal data stored in ph26 databases is encrypted using AES-256 or equivalent standards.
• Password security: Account passwords are stored as salted hashes using industry-standard algorithms. ph26 never stores plaintext passwords.
• Access controls: Access to personal data within ph26's systems is restricted to authorised personnel on a need-to-know basis, enforced through role-based access control.
• Payment security: Payment processing is handled through PCI-DSS compliant payment service providers. ph26 does not store full payment card numbers or GCash/Maya account credentials.
• Penetration testing: ph26 conducts regular security testing to identify and remediate vulnerabilities in its platform.
• Incident response: ph26 maintains a personal data breach response procedure. In the event of a breach likely to result in harm to Data Subjects, ph26 will notify the NPC within 72 hours and affected individuals without undue delay, as required by law.

While ph26 takes all commercially reasonable steps to protect your data, no internet-based platform can guarantee absolute security. You are encouraged to use strong, unique passwords and enable two-factor authentication on your ph26 account.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ph26:

• Right to be informed: To be informed about how ph26 collects and processes your personal data — addressed by this Policy.
• Right of access: To obtain confirmation of whether ph26 holds your personal data and to receive a copy of that data.
• Right to rectification: To have inaccurate or incomplete personal data corrected or completed. You may update most account details directly within your ph26 account settings.
• Right to erasure: To request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to ph26's legal retention obligations (e.g., PAGCOR/AMLC recordkeeping requirements may preclude immediate deletion).
• Right to data portability: To receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: To object to processing of your personal data for marketing purposes at any time. Withdrawal of consent for marketing communications does not affect the lawfulness of processing for contractual or legal compliance purposes.
• Right to file a complaint: To file a complaint with the National Privacy Commission of the Philippines if you believe your data protection rights have been violated.

To exercise any of these rights, submit a written request to ph26's Data Protection Officer at the contact details provided in Section 14. ph26 will respond within fifteen (15) working days of receiving a verifiable request.

11. Children's Privacy

The ph26 platform is intended exclusively for individuals aged twenty-one (21) years and older. ph26 does not knowingly collect personal data from individuals under 21 years of age. Age verification is conducted as part of the ph26 account registration and KYC process.

If ph26 becomes aware that personal data has been collected from an individual below the minimum age, that account will be suspended immediately, the data will be deleted (subject to any legal retention obligations related to the regulatory investigation), and any funds associated with the underage account will be handled in accordance with PAGCOR guidance.

If you believe that ph26 may have inadvertently collected data from a person under 21, please contact ph26 immediately through the official support channels listed in Section 14.

12. International Data Transfers

ph26's primary data processing infrastructure is located within the Philippines. Where ph26 engages service providers (e.g., cloud infrastructure or KYC verification platforms) that may process data outside the Philippines, ph26 ensures that such transfers are subject to adequate safeguards, including contractual data processing agreements that impose data protection standards equivalent to those required under RA 10173.

ph26 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate safeguards and, where required, obtaining your consent or NPC approval.

13. Changes to This Policy

ph26 may update this Privacy Policy from time to time to reflect changes in its data processing practices, regulatory requirements, or platform features. The "Last Updated" date at the top of this Policy indicates when it was most recently revised.

Where changes are material, ph26 will provide notice to registered users via email or a prominent notice on the ph26 platform at least seven (7) days before the changes take effect, except where an immediate change is required by law. Your continued use of ph26 services following the effective date of a revised Policy constitutes your acceptance of the updated terms.

14. Contact & Data Protection Officer

ph26 has designated a Data Protection Officer (DPO) responsible for overseeing ph26's compliance with the Data Privacy Act of 2012 and this Policy. For any privacy-related enquiries, data subject rights requests, or concerns, please contact the ph26 DPO through the following official channels:

• Email: [email protected] — mark your subject line as "Data Privacy Request" or "DPO Enquiry."
• Live Chat: Available 24/7 within your ph26 account dashboard. For formal DPO matters, email is preferred.

ph26 will acknowledge receipt of your privacy request promptly and provide a substantive response within fifteen (15) working days. Complex requests may require additional time, in which case ph26 will notify you of the extended timeline and reason.

If you are not satisfied with ph26's response to a privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (privacy.gov.ph).