ph388 Privacy Policy

1.1 This Privacy Policy ("Policy") is issued by the operator of ph388.org ("ph388", "we", "us", "our") and applies to all personal data collected from individuals who access, register with, or otherwise interact with the ph388 platform, whether through a desktop browser, mobile browser, or any other access method.

1.2 "Personal data" in this Policy refers to any information from which a living individual can be directly or indirectly identified, as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

1.3 This Policy applies to all data subjects whose personal data is processed by ph388, including registered players, prospective players who interact with the Platform without completing registration, and individuals who contact our support team.

1.4 This Policy should be read alongside the Terms & Conditions, which govern your overall contractual relationship with ph388. In the event of any inconsistency between this Policy and the Terms & Conditions on a data privacy matter, this Policy shall prevail.

2.1 ph388 processes personal data in accordance with the following Philippine legal instruments:

• Republic Act No. 10173 — the Data Privacy Act of 2012, which establishes the framework for the collection, processing, storage, and protection of personal data in the Philippines;
• NPC Circular No. 16-01 and other issuances of the National Privacy Commission;
• Republic Act No. 9160 (Anti-Money Laundering Act) and its amendments, which require the collection and retention of identity and transaction data for regulatory purposes;
• PAGCOR Regulatory Requirements — as a licensed gaming operator, ph388 is required to collect and retain certain player data as directed by the Philippine Amusement and Gaming Corporation.

2.2 ph388 acts as the Personal Information Controller (PIC) in respect of personal data collected through ph388.org, and is responsible for ensuring that such data is processed lawfully, fairly, and transparently.

3.1 ph388 collects personal data through the following channels: account registration, identity verification (KYC), deposit and withdrawal transactions, gameplay activity, customer support interactions, and technical data collected automatically through your use of the Platform.

3.2 ph388 does not collect sensitive personal information as defined under the Data Privacy Act (such as medical records, political affiliations, or religious beliefs) unless specifically required to do so for responsible gaming compliance purposes, in which case such collection will be clearly disclosed at the time of collection.

4.1 ph388 uses collected personal data for the following purposes:

• Creating, maintaining, and managing your ph388 player account;
• Processing your deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, and other supported payment channels;
• Enabling your access to and participation in all game categories on the Platform;
• Managing your VIP tier status and processing eligible bonuses and promotions.

• Conducting identity verification (KYC) as required by PAGCOR regulations;
• Meeting our anti-money laundering (AML) and counter-terrorist financing (CTF) obligations under Republic Act No. 9160 and PAGCOR requirements;
• Reporting to the Anti-Money Laundering Council (AMLC) and other competent Philippine authorities where legally required;
• Enforcing the 21+ age restriction and eligibility requirements applicable to all ph388 players.

• Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and other prohibited conduct;
• Monitoring account activity for security anomalies and responding to reported account compromises;
• Maintaining audit logs for security incident response and regulatory accountability.

• Analysing aggregated and anonymised gameplay data to improve Platform features and game selection;
• Sending service-related communications including account notifications, transaction confirmations, and security alerts;
• Sending promotional communications about ph388 offers and bonuses to players who have opted in to receive such communications (opt-out available at any time).

5.1 Under the Data Privacy Act of 2012, ph388 relies on the following legal grounds for processing your personal data:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as a registered player, including operating your account, processing transactions, and delivering gaming services;
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulatory requirements, anti-money laundering obligations, and taxation requirements;
• Legitimate Interests: Processing carried out for fraud prevention, security monitoring, and Platform improvement, where such interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, where you have expressly opted in to receive such communications. You may withdraw this consent at any time by contacting our support team or using the unsubscribe function in any marketing email.

6.1 ph388 may share your personal data with the following categories of third parties:

• Payment Service Providers: GCash (GXI), Maya (Voyager Innovations), GrabPay (GrabFinancial), and banking partners (BPI, BDO, Metrobank) — to process your deposits and withdrawals. These providers handle your data under their own privacy policies and applicable Philippine financial services regulations;
• Identity Verification Providers: Third-party KYC technology providers who assist with document verification and biometric liveness checks, operating under data processing agreements with ph388;
• Game Providers: Jili Games, Fachai Gaming, Pragmatic Play, PG Soft, Spadegaming, and other studios whose games are hosted on the Platform. These providers receive limited technical data (such as player session tokens) necessary to operate game rounds;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government bodies, where disclosure is legally required or ordered by a court of competent jurisdiction;
• IT Infrastructure and Security Providers: Cloud hosting, database management, and cybersecurity service providers operating under contractual data protection obligations.

6.2 All third-party service providers who handle personal data on behalf of ph388 are bound by data processing agreements requiring them to process that data only for the purposes authorised by ph388 and in compliance with applicable Philippine data protection law.

7.1 ph388 uses cookies and similar tracking technologies on ph388.org for the following purposes:

7.2 Strictly necessary cookies cannot be disabled as they are essential to the operation of the Platform. All other cookie categories can be managed through your browser settings. Note that disabling functional cookies may impact your experience on the Platform.

8.1 ph388 implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and ph388.org is encrypted in transit;
• Encryption at Rest: Sensitive personal data (including identity documents and financial details) is encrypted at rest in our database systems;
• Access Controls: Internal access to personal data is restricted to authorised personnel on a strict need-to-know basis, authenticated through multi-factor authentication;
• Regular Security Audits: ph388 conducts periodic vulnerability assessments and penetration testing to identify and address security weaknesses;
• Incident Response Plan: ph388 maintains a documented data breach response plan compliant with NPC notification requirements under the Data Privacy Act.

8.2 In the event of a personal data breach that is likely to result in harm to affected individuals, ph388 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected individuals as required by law.

8.3 While ph388 takes all reasonable security measures, no system is completely impenetrable. Players are reminded to use strong, unique passwords for their accounts and to notify ph388 immediately if they suspect any unauthorised account access.

9.1 ph388 retains personal data for the following periods, after which data is securely deleted or irreversibly anonymised:

9.2 Where retention is required beyond account closure for legal or regulatory reasons, data retained for those purposes will be held in a restricted-access archive and used only for those specific compliance purposes.

10.1 Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to your personal data held by ph388:

10.2 To exercise any of the above rights, please submit a written request to our Data Privacy Officer at [email protected] with the subject line "Data Privacy Request". ph388 will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days, or within such period as permitted by the Data Privacy Act and NPC guidelines.

10.3 We may request additional identity verification before processing a data subject rights request to ensure we do not disclose personal data to an unauthorised person.

11.1 The Platform's age verification process is designed to prevent access by underage individuals. Any account found to belong to a person under 21 years of age will be immediately closed and all data associated with that account will be handled in accordance with this Policy and applicable law.

11.2 If ph388 discovers that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account. If you believe that an underage individual has created a ph388 account, please contact us immediately at [email protected].

12.1 ph388 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this document will be revised each time a change is made.

12.2 Where changes are material — meaning they significantly affect your rights or the way we process your personal data — ph388 will notify registered players by email or through a notice displayed on the Platform at least fourteen (14) days before the changes take effect.

12.3 Your continued use of the Platform after any amendment to this Policy constitutes your acknowledgement of the updated Policy. If you do not agree with any material amendment, you may close your account by contacting our support team.

13.1 ph388 has designated a Data Privacy Officer (DPO) responsible for overseeing compliance with this Policy and with the Philippine Data Privacy Act. The DPO may be contacted as follows:

• Email: [email protected] (Subject: "Data Privacy Request" or "DPO Enquiry")
• Platform: ph388.org — Live chat available 24/7 through your registered account

13.2 If you are not satisfied with ph388's response to your data privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for enforcing the Data Privacy Act of 2012 in the Philippines.

13.3 ph388 is committed to resolving all data privacy concerns raised by players promptly and in good faith. We encourage you to contact us directly in the first instance before escalating to the NPC, as most concerns can be resolved through direct engagement with our DPO.