phndot Privacy Policy

1.1 Who We Are. phndot is a premier online casino and sports betting platform serving Filipino players across Manila, Cebu, Davao, Quezon City, and beyond. phndot operates in compliance with applicable Philippine gaming regulations and is committed to upholding the highest standards of data privacy and information security in the handling of user personal data.

1.2 Scope of This Policy. This Privacy Policy applies to all personal data processed by phndot in connection with your use of the phndot platform — including registration, account management, deposits, withdrawals, gameplay, sports betting, bingo participation, customer support interactions, and marketing communications. It applies regardless of the device (desktop, mobile browser, or app) through which you access the platform.

1.3 Data Controller. phndot acts as the data controller in respect of your personal data. This means phndot determines the purposes and means of processing your personal information. Where phndot engages third-party service providers to process data on its behalf, those providers act as data processors subject to phndot's instructions and binding data processing agreements.

1.4 Relationship to Terms and Conditions. This Privacy Policy forms part of and should be read alongside the phndot Terms and Conditions. In the event of any inconsistency between the two documents on matters of data privacy, this Privacy Policy prevails.

phndot collects the following categories of personal data from users and prospective users of the platform:

2.1 Sensitive Personal Information. phndot does not intentionally collect sensitive personal information as defined under RA 10173 (such as health data, religious beliefs, or political affiliations) except where strictly required by specific regulatory obligations — for example, collecting information about problem gambling history in connection with responsible gaming self-exclusion requests.

phndot collects personal data through the following means:

3.1 Direct Collection. The majority of personal data phndot holds about you is provided directly by you — during account registration, KYC document submission, deposit and withdrawal requests, responsible gaming tool activation, customer support interactions, and responses to promotional communications.

3.2 Automated Collection. When you access and use the phndot platform, certain technical and usage data is collected automatically through cookies, web beacons, server logs, and similar tracking technologies. This data is collected to ensure platform security, optimise performance, and personalise your experience. See Section 7 for full details on cookies and tracking.

3.3 Third-Party Sources. phndot may receive limited personal data about you from trusted third parties in specific circumstances, including:

• Identity verification and KYC service providers used to confirm the authenticity of government-issued Philippine ID documents you submit.
• Payment processors (GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, GrabPay) who confirm the status and reference details of transactions initiated by you.
• Fraud prevention and AML screening services that cross-reference your details against relevant watchlists as required by Philippine AML law.
• Licensed game providers, where game session data is reported back to phndot for account crediting and responsible gaming monitoring purposes.

phndot uses your personal data for the following purposes:

• Account Creation and Management: To register your phndot account, verify your identity, maintain your account in good standing, and communicate account-related information to you.
• Age and Eligibility Verification: To confirm that you are at least 21 years of age and otherwise eligible to use the phndot platform under Philippine gaming law.
• Payment Processing: To process deposits via GCash, Maya, BDO, BPI, Metrobank, InstaPay, PesoNet, GrabPay, QR Ph, and 7-Eleven CLiQQ, and to process withdrawal requests back to your verified payment method.
• Service Delivery: To provide access to phndot's full range of games, live dealer tables, sports betting markets, bingo rooms, and promotional features.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, to administer self-exclusion and deposit limit tools you activate, and to enforce exclusion orders received from PAGCOR or other regulatory bodies.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, and other prohibited conduct on the platform.
• Regulatory Compliance: To meet our obligations under PAGCOR regulations, the Anti-Money Laundering Act, and other applicable Philippine law — including reporting obligations to the Anti-Money Laundering Council (AMLC).
• Customer Support: To respond to your support queries, complaints, and account requests via the 24/7 live chat and email channels.
• Marketing and Promotions: Where you have given consent, to send you information about phndot promotions, bonuses, new game launches, and platform updates that may be relevant to your interests. You may withdraw this consent at any time.
• Platform Improvement: To analyse aggregated and anonymised usage data to improve the phndot platform's performance, user experience, and game selection.

Under the Philippine Data Privacy Act of 2012, phndot relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing that is necessary to perform our contract with you — i.e., to operate your phndot account, process transactions, and deliver gaming services as described in the Terms and Conditions.
• Legal Obligation: Processing required to comply with our obligations under Philippine law — including PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act itself.
• Legitimate Interests: Processing necessary for phndot's legitimate business interests, including fraud prevention, platform security, and internal analytics — provided those interests are not overridden by your fundamental rights and interests as a data subject.
• Consent: Where phndot processes data for marketing and promotional communications, the legal basis is your explicit consent. You may withdraw consent at any time via your Account notification settings or by contacting Support, without affecting the lawfulness of processing already carried out.

6.1 Third-Party Service Providers. phndot shares your personal data with carefully vetted third-party service providers who process data on phndot's behalf and under phndot's instructions. These providers are bound by data processing agreements that require them to maintain appropriate security measures and prohibit them from using your data for any purpose other than delivering the contracted service. Categories of providers include:

• KYC and identity verification platforms.
• Payment gateway operators and e-wallet providers (GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, PesoNet, 7-Eleven CLiQQ).
• Licensed third-party game and live dealer software providers.
• Cloud hosting and infrastructure providers.
• Customer support platform providers.
• Fraud detection and AML screening services.

6.2 Regulatory Disclosure. phndot is legally required to share certain user data with Philippine regulatory and law enforcement authorities upon valid request or pursuant to mandatory reporting obligations. This includes PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities. phndot will not share data with regulatory bodies beyond what is strictly required by applicable law.

6.3 No Sale of Data. phndot does not sell, rent, trade, or otherwise transfer your personal data to third parties for their own commercial purposes. Any data sharing is strictly for the purposes described in this Privacy Policy.

6.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of phndot's assets, your personal data may be transferred as part of that transaction. If such a transfer occurs, phndot will ensure the receiving party is bound by obligations no less protective than those in this Privacy Policy, and will notify affected users via email in advance where reasonably practicable.

7.1 What Are Cookies. Cookies are small text files placed on your device when you visit the phndot platform. They allow phndot to recognise your device on subsequent visits, maintain your session, remember your preferences, and gather analytics data about how the platform is used.

7.2 Types of Cookies Used. phndot uses the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the platform — for example, session cookies that keep you logged in and security cookies that prevent cross-site request forgery attacks. These cannot be disabled without severely impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations across sessions.
• Analytics Cookies: Collect anonymised and aggregated data about how users navigate the platform — pages visited, time spent, features used — to help phndot improve the user experience.
• Security Cookies: Used to detect unusual login patterns, multiple account attempts, and other security-relevant behaviours.

7.3 Managing Cookies. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in and using the phndot platform. Instructions for managing cookies are available in the help documentation of all major browsers.

8.1 Retention Principles. phndot retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable Philippine law. Once data is no longer required, phndot takes steps to securely delete or anonymise it.

8.2 Retention Periods. The following general retention periods apply to key categories of data held by phndot:

• Account and Identity Data: Retained for the duration of your phndot account plus five (5) years after account closure, to comply with AML, tax, and regulatory record-keeping obligations.
• Transaction Records: Retained for five (5) years following each transaction, in line with Philippine AML requirements under RA 9160.
• KYC Documents: Retained for five (5) years after account closure or as required by the relevant regulatory body.
• Support Communications: Retained for three (3) years from the date of the interaction, for complaint resolution and quality assurance purposes.
• Marketing Data: Retained until you withdraw consent to marketing communications, at which point it is promptly deleted from active marketing systems.
• Technical and Usage Data: Anonymised and aggregated after thirteen (13) months for analytics purposes. Raw technical logs retained for up to twelve (12) months for security investigation purposes.

8.3 Legal Hold. In cases where phndot is subject to a legal hold, regulatory investigation, or active dispute, relevant data will be retained beyond standard retention periods until the matter is fully resolved.

9.1 Security Measures. phndot implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the phndot platform.
• AES-256 encryption for personal data stored in phndot's databases.
• Role-based access controls ensuring that only authorised phndot personnel with a legitimate need can access personal data.
• Multi-factor authentication for phndot internal systems access.
• Regular security vulnerability assessments and penetration testing of the phndot platform.
• Continuous monitoring for suspicious access patterns and automated alerting for potential security incidents.
• Physical security controls at data centre facilities hosting phndot infrastructure.

9.2 Your Responsibilities. While phndot takes extensive measures to secure your data on our side, you also play a role in keeping your account secure. You are responsible for maintaining the confidentiality of your phndot login credentials and for notifying phndot Support immediately if you suspect that your account has been accessed without your authorisation. phndot will never ask for your password via email, live chat, or any other channel.

9.3 No Absolute Guarantee. Despite phndot's best efforts, no method of electronic transmission or storage is 100% secure. phndot cannot guarantee the absolute security of data transmitted over the internet. We will, however, respond promptly and responsibly to any security incident affecting user personal data.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by phndot:

• Right to Be Informed: The right to know that phndot is collecting your data, the purpose of collection, the scope and method of processing, and your rights as a data subject — all of which are covered in this Privacy Policy.
• Right to Access: The right to request a copy of the personal data phndot holds about you, information on how it is being processed, and the identities of third parties with whom it has been shared.
• Right to Rectification: The right to request correction of any inaccurate, incomplete, or outdated personal data phndot holds about you.
• Right to Erasure or Blocking: The right to request that phndot erase or block your personal data where it is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is unlawful — subject to phndot's overriding legal retention obligations.
• Right to Object: The right to object to phndot processing your personal data for direct marketing purposes. Upon receipt of a valid objection, phndot will cease processing your data for that purpose immediately.
• Right to Data Portability: The right to receive a copy of the personal data you provided to phndot in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Damages: The right to be compensated for any damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully processed personal data, in accordance with the provisions of RA 10173.
• Right to Complain: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe phndot has processed your personal data in violation of RA 10173.

10.1 Exercising Your Rights. To exercise any of the rights listed above, please contact phndot's Data Protection Officer via the 24/7 live chat widget or by emailing [email protected]. phndot will respond to valid data subject requests within fifteen (15) business days of receipt, in line with NPC guidelines.

11.1 Age Restriction. The phndot platform is strictly intended for individuals aged 21 years and above. phndot does not knowingly collect, process, or store personal data from individuals under the age of 21. The 21+ age requirement is mandated by Philippine gaming law and is enforced through phndot's KYC verification process at the point of registration.

11.2 Discovery of Underage Data. If phndot discovers or is notified that personal data has been collected from a person under 21 years of age, phndot will immediately close the associated account, refund any verified balance in accordance with applicable regulations, delete the personal data of the underage user from its systems as expeditiously as possible, and take appropriate steps to prevent recurrence.

11.3 Parental Notification. If you are a parent or guardian and believe that a minor in your care has registered on the phndot platform without your knowledge, please contact phndot Support immediately via the 24/7 live chat widget so we can take appropriate action without delay.

12.1 Primary Storage. phndot's primary data storage and processing infrastructure is located within or serves the Philippine market. phndot takes steps to ensure that data processing arrangements reflect the requirements of Philippine data protection law.

12.2 Cross-Border Transfers. In some cases, phndot's third-party service providers — including licensed game software vendors and cloud infrastructure providers — may process data outside the Philippines. Where such cross-border data transfers occur, phndot ensures that appropriate safeguards are in place, including contractual data processing agreements that impose data protection standards equivalent to those required by RA 10173.

12.3 NPC Registration. Where required by NPC regulations, phndot maintains registration of its personal data processing systems with the National Privacy Commission and discloses cross-border data transfer arrangements as part of that registration.

13.1 Right to Update. phndot reserves the right to update or modify this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance from the NPC or PAGCOR, phndot's data processing practices, or the services offered on the platform.

13.2 Notification of Changes. For material changes to this Privacy Policy — such as changes to the categories of data collected, new third-party sharing arrangements, or changes to your rights — phndot will notify registered users via email to their registered address at least fourteen (14) days before the changes take effect, and will publish a prominent notice on the phndot platform.

13.3 Continued Use. Your continued use of the phndot platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the revised Privacy Policy, you should discontinue use of the platform and may request account closure in accordance with the phndot Terms and Conditions.

13.4 Version History. The current version of this Privacy Policy was last updated in January 2026. Previous versions are available upon request by contacting phndot Support.

phndot has appointed a Data Protection Officer (DPO) in compliance with Section 21 of the Philippine Data Privacy Act of 2012 and NPC Circular 17-01. The DPO is responsible for overseeing phndot's compliance with RA 10173, responding to data subject rights requests, and serving as the primary point of contact with the National Privacy Commission.