phparm Privacy Policy

This Privacy Policy ("Policy") is issued by phparm ("phparm," "we," "us," or "our"), the operator of the online gaming platform accessible at phparm.club. This Policy describes how phparm processes the personal data of individuals ("you," "Data Subject," or "Player") who: (a) register for a phparm player account; (b) access or use the phparm Platform; (c) contact phparm support; or (d) interact with phparm through any other channel.

This Policy applies to all personal data processing activities conducted by phparm in connection with the Platform, including data collected through the website, mobile browser interface, customer support communications, payment processing, and marketing communications. It applies to all Filipino players and any individual whose personal data is processed by phparm in connection with Platform operations, regardless of their location.

This Policy should be read together with the phparm Terms & Conditions, the Responsible Gaming Policy, and any specific consent notices presented to you at the point of data collection. By registering for a phparm account, you acknowledge that you have read and understood this Policy.

For the purposes of the Philippine Data Privacy Act of 2012, phparm is the Personal Information Controller (PIC) in respect of personal data processed through the phparm Platform. As PIC, phparm determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted lawfully, fairly, and transparently in accordance with the DPA.

phparm has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA, managing data subject rights requests, and coordinating with the National Privacy Commission. The DPO can be contacted through the details provided in Section 16 of this Policy.

Third-party service providers engaged by phparm — including game providers, payment processors, and identity verification services — act as Personal Information Processors (PIPs) where they process personal data on phparm's behalf under binding data processing agreements. phparm remains responsible for ensuring that all PIPs provide sufficient data protection guarantees consistent with the DPA.

phparm collects personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this Policy. The categories of personal data phparm processes are set out below.

phparm collects personal data through the following means:

4.1 Direct Collection

Data you provide directly to phparm when: completing the registration form; submitting KYC verification documents; making deposits or requesting withdrawals; contacting phparm customer support; responding to surveys or promotions; or adjusting your account settings or responsible gaming preferences.

4.2 Automated Collection

Technical and usage data collected automatically when you access the phparm Platform, including through cookies, browser local storage, session logs, server-side game outcome records, and security monitoring systems. See Section 11 for full details on cookies and tracking technologies used by phparm.

4.3 Third-Party Sources

phparm may receive data about you from third parties in the following circumstances: (a) identity verification providers who conduct KYC checks on phparm's behalf; (b) payment processors such as GCash and Maya who confirm transaction details; (c) fraud detection services who flag potentially suspicious activity patterns; and (d) PAGCOR or other regulatory bodies pursuant to their lawful authority. In all cases, phparm verifies that third-party sources are authorised to share such data before it is processed.

Under the Philippine Data Privacy Act, phparm processes your personal data on one or more of the following lawful bases, depending on the specific processing activity:

1. Contractual Necessity: Processing required to perform our obligations under the phparm Terms & Conditions — including account management, game play facilitation, deposit and withdrawal processing, and bonus administration. Without this processing, phparm cannot provide its services to you.
2. Legal Obligation: Processing required for phparm to comply with applicable Philippine laws — including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), the Data Privacy Act (DPA), Bangko Sentral ng Pilipinas (BSP) regulations applicable to payment processing, and Philippine tax laws. phparm cannot waive legally mandated processing obligations on the basis of individual objection.
3. Legitimate Interests: Processing for phparm's legitimate business interests where these are not overridden by your rights — including fraud prevention, account security monitoring, platform optimisation, game performance analysis, and responsible gaming pattern monitoring. phparm conducts a balancing assessment before relying on this basis.
4. Consent: Processing for direct marketing communications, optional analytics, and certain cookie deployments where your freely given, specific, and informed consent has been obtained. Where phparm relies on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

phparm uses your personal data for the following specific purposes:

6.1 Platform Operations

• Creating and managing your phparm player account, including authentication and session management;
• Processing deposits and withdrawals via GCash, Maya, and other supported Philippine payment methods;
• Facilitating game play, recording game outcomes, and maintaining your transaction history;
• Administering bonuses, calculating wagering requirements, and managing your phparm Rewards loyalty points;
• Providing customer support, handling disputes, and processing complaints.

6.2 Compliance & Regulatory Obligations

• Verifying your identity and age (21+) as required by PAGCOR and Philippine gaming law;
• Conducting anti-money laundering (AML) screening and reporting as required under the AMLA and its amendments;
• Submitting player activity reports to PAGCOR in accordance with phparm's licensing conditions;
• Maintaining records of transactions and game activity for the periods required by applicable Philippine law.

6.3 Security & Fraud Prevention

• Detecting and preventing unauthorised account access, credential theft, and account takeover attempts;
• Identifying and investigating fraudulent deposits, chargebacks, and bonus abuse;
• Enforcing the one-account-per-player rule and detecting multiple account registrations.

6.4 Responsible Gaming

• Monitoring player activity patterns for indicators of problem gambling behaviour;
• Enforcing self-imposed limits, cooling-off periods, and self-exclusion requests;
• Implementing mandatory account restrictions where required by PAGCOR's responsible gaming framework.

6.5 Marketing Communications

With your consent, phparm may send you promotional communications about bonuses, new games, tournaments, and platform updates via your registered email address or Philippine mobile number. You may withdraw consent for marketing communications at any time by updating your notification preferences within your phparm account dashboard or by contacting phparm support.

phparm does not sell, rent, or trade your personal data with any third party for commercial gain. phparm discloses personal data only in the following circumstances and only to the extent necessary for the stated purpose:

7.1 Service Providers (Personal Information Processors)

phparm engages carefully selected third-party service providers who process personal data on phparm's behalf under binding data processing agreements that impose data protection obligations consistent with the DPA. These include: identity verification providers (for KYC processing); payment processors (GCash, Maya, Visa, Mastercard, and linked banking partners); game software providers (for game outcome verification); hosting and cloud infrastructure providers; and customer support platform providers.

7.2 Regulatory & Law Enforcement Authorities

phparm will disclose personal data to competent Philippine regulatory or law enforcement authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Bureau of Investigation (NBI), and the National Privacy Commission (NPC) — where required by law, court order, or regulatory directive. phparm will inform you of such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring of phparm's business, your personal data may be transferred to a successor entity as part of that transaction. phparm will provide reasonable notice of such transfer and ensure that the successor entity assumes equivalent data protection obligations under the DPA.

7.4 Self-Exclusion Registries

Where a player activates self-exclusion through the phparm Platform, phparm may register that exclusion with the PAGCOR self-exclusion programme or other applicable industry-wide exclusion registry. This disclosure is made to protect the player's welfare and is authorised under phparm's PAGCOR licensing conditions.

Some of phparm's third-party service providers — particularly game software providers and cloud infrastructure vendors — may be located outside the Philippines. Where personal data is transferred to countries that do not provide an equivalent level of data protection to the Philippines, phparm implements appropriate safeguards to protect your data in accordance with Section 21 of the DPA and the NPC's rules on cross-border data transfers.

These safeguards include: contractual data protection clauses that bind foreign recipients to DPA-equivalent obligations; transfers only to recipients in countries with adequate data protection frameworks as recognised by the NPC; and where required, obtaining your prior consent for specific international transfers.

phparm maintains a register of all cross-border data transfers and will make this register available to the NPC upon request. You may contact the phparm Data Protection Officer (see Section 16) to request information about specific cross-border transfer safeguards applicable to your personal data.

phparm retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Philippine law, whichever is longer. The primary retention periods applied by phparm are as follows:

At the end of the applicable retention period, phparm will securely delete or anonymise personal data in a manner that prevents reconstruction. Anonymised data that cannot be re-linked to an individual may be retained indefinitely for statistical and platform improvement purposes.

phparm implements a layered, risk-based information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. The technical and organisational measures applied by phparm include:

10.1 Technical Safeguards

• 256-bit SSL/TLS encryption on all data in transit between your device and phparm servers — the same encryption standard used by Philippine banks and e-wallet providers;
• Encryption at rest for sensitive personal data including KYC documents, payment account details, and authentication credentials;
• Password hashing using industry-standard one-way hashing algorithms — phparm does not store your password in recoverable form;
• Two-Factor Authentication (2FA) available to all accounts, strongly recommended for all players;
• Session security tokens that expire after inactivity and are invalidated upon logout;
• Intrusion detection and monitoring systems that continuously scan for anomalous access patterns and potential data breaches.

10.2 Organisational Safeguards

• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular data protection training for all staff who handle personal data;
• Contractual data protection obligations imposed on all third-party service providers;
• Documented incident response procedures for personal data breaches, including NPC notification within 72 hours where required under the DPA.

phparm uses cookies and similar tracking technologies on the phparm Platform to provide functionality, maintain your session, protect account security, and (with your consent) analyse Platform usage patterns. A cookie is a small text file placed on your device when you access the Platform.

11.1 Categories of Cookies Used by phparm

• Strictly Necessary Cookies: Essential for Platform operation — including session authentication tokens, security tokens, and cookies that maintain your logged-in state. These cannot be disabled as they are required for the Platform to function. No consent is required for these cookies under Philippine law.
• Functional Cookies: Remember your preferences — such as language settings, game lobby layout preferences, and notification settings — to personalise your experience. These are deployed on the basis of our legitimate interests and your implied consent through continued use.
• Analytics Cookies: Collect aggregate, anonymised data about how players use the Platform — such as pages visited, features used, and session duration — to help phparm improve the Platform. These are deployed only with your consent.
• Security Cookies: Support fraud detection, account security monitoring, and anomaly detection functions. These are strictly necessary and cannot be disabled.

11.2 Managing Cookies

You may configure your browser to reject non-essential cookies or delete existing cookies at any time. Please note that disabling strictly necessary cookies will impair or prevent your ability to use the phparm Platform, including preventing login. Analytics and marketing cookies can be disabled via your account notification preferences without affecting Platform functionality.

As a Data Subject under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data processed by phparm. phparm will respond to all valid rights requests within the timeframes specified by the DPA and NPC regulations.

To exercise any of these rights, submit your request in writing to phparm's Data Protection Officer at [email protected], clearly identifying your registered phparm account, the right you are exercising, and supporting information. phparm will verify your identity before processing any rights request and will respond within 15 business days. Complex requests may require up to 30 days with notice of the extension.

The phparm Platform is strictly restricted to individuals aged 21 years and above. phparm does not knowingly collect personal data from anyone under the age of 21. The Platform's age verification and KYC processes are designed to identify and reject any registration attempt by a person under 21 years of age.

If phparm discovers or has reasonable grounds to believe that personal data has been collected from a person under 21 years of age — whether through circumvention of age verification or other means — phparm will immediately: (a) restrict the relevant account; (b) conduct an investigation; (c) delete all personal data associated with the underage user, except to the extent required by law; and (d) refund any deposited funds to their source in accordance with applicable Philippine gaming regulations.

Parents or guardians who believe that phparm may have inadvertently collected personal data from a minor in their care are encouraged to contact the phparm Data Protection Officer immediately at [email protected].

The phparm Platform integrates with third-party services — including game providers, payment gateways, and identity verification systems — whose own privacy practices are separate from and independent of this Policy. phparm has entered into data processing agreements with all such third-party service providers to ensure they process your data only as directed by phparm and in accordance with DPA-equivalent standards.

phparm is not responsible for the privacy practices of GCash, Maya, Visa, Mastercard, BPI, BDO, Metrobank, or any other payment provider you use to make deposits to or withdrawals from your phparm account. Transactions processed through those providers are subject to their own privacy policies, which you should review independently.

The phparm Platform does not contain outbound links to third-party websites. Where phparm refers players to resources such as the National Council on Problem Gambling Philippines (NCPG-PH) or PAGCOR for responsible gaming support, those organisations operate under their own privacy frameworks independent of phparm.

phparm reserves the right to update this Privacy Policy to reflect changes in applicable Philippine law, NPC regulations, phparm's data processing activities, or best practice standards. The effective date at the top of this Policy reflects the date of the most recent revision.

Where amendments are material — meaning they significantly affect your rights or how your personal data is processed — phparm will notify you by email to your registered address and post a prominent notice on the phparm Platform at least 14 days before the amended Policy takes effect. Minor corrections and clarifications that do not change the substance of your rights may be published without advance notice.

Your continued use of the phparm Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not accept material amendments, you should stop using the Platform and may request account closure as described in the phparm Terms & Conditions. phparm will process any real-money balance in accordance with those Terms regardless of your decision not to accept the amended Policy.

For any questions, concerns, or requests relating to this Privacy Policy or phparm's data processing activities, please contact the phparm Data Protection Officer:

Data Protection Officer — phparm
Email: [email protected]
Subject Line: DPA Rights Request or Privacy Policy Enquiry
Response Time: phparm acknowledges all DPO enquiries within 5 business days. Full responses to rights requests are provided within 15 business days, extendable to 30 days for complex requests with prior notice.
Support Hours: 24 hours a day, 7 days a week

If you are not satisfied with phparm's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines — the supervisory authority for data protection in the Philippines.