ph956 Privacy Policy — Your Data, Your Rights

This Privacy Policy (hereinafter "Policy") is issued by ph956 (hereinafter "ph956," "we," "us," or "our"), the operator of the online gaming platform accessible at ph956.vip (the "Platform"). This Policy applies to all personal information collected, processed, stored, and used by ph956 in connection with your access to and use of the Platform, including account registration, deposits, gameplay, withdrawals, customer support interactions, and marketing communications.

ph956 is committed to handling your personal information responsibly and in full compliance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA"), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines. This Policy also reflects ph956's obligations under PAGCOR's licensing framework with respect to player data and Know Your Customer (KYC) requirements.

By registering an account on ph956, depositing funds, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you should not create an account on ph956 and must cease using the Platform.

2.1 Identity of the Data Controller. For the purposes of the Data Privacy Act of 2012, ph956 is the Data Controller in respect of all personal data collected through the Platform. As Data Controller, ph956 determines the purposes and means by which your personal data is processed.

2.2 Data Protection Officer. ph956 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the DPA and NPC regulations. The DPO is responsible for overseeing ph956's data protection compliance, handling data subject requests, and serving as the point of contact for the National Privacy Commission. DPO inquiries may be directed to ph956's support channels as specified in Section 15.

2.3 NPC Registration. ph956 has registered its personal data processing systems with the National Privacy Commission of the Philippines as required under the DPA and NPC Circular No. 17-01 for personal information controllers operating automated processing systems.

ph956 collects the following categories of personal data in connection with the provision of its services:

3.1 Sensitive Personal Information. In limited circumstances, ph956 may collect sensitive personal information as defined under Section 3(l) of the DPA, including government-issued ID numbers required for KYC compliance. ph956 collects only the minimum sensitive personal information necessary for regulatory compliance and processes such data with additional safeguards as described in Section 8.

3.2 Data Not Collected. ph956 does not collect full payment card numbers (PAN data). Philippine bank account numbers provided for withdrawal purposes are encrypted immediately upon receipt and stored only in tokenized form.

ph956 collects personal data through the following channels and mechanisms:

• Direct Provision: Information you provide when completing the ph956 registration form, submitting KYC documentation, updating your account profile, or communicating with our support team via live chat or email.
• Automated Technical Collection: Data automatically generated by your use of the Platform, including IP addresses, device identifiers, session data, click-stream data, and gameplay records, collected through ph956's server infrastructure and analytics systems.
• Cookie and Similar Technologies: Data collected via cookies, web beacons, and similar tracking technologies as described in Section 9 of this Policy.
• Payment Processors: Transaction confirmation data and payment method identifiers shared by approved Philippine payment processors (GCash, PayMaya, BPI, BDO, Metrobank) upon completion of deposit or withdrawal transactions.
• Third-Party Identity Verification Services: Identity and age verification data obtained through third-party KYC service providers engaged by ph956 to fulfil its PAGCOR-mandated verification obligations.
• Fraud Detection Services: Device and behavioral data obtained through fraud prevention systems to detect unauthorized account access, multi-accounting, and financial fraud.

ph956 processes your personal data only where a lawful basis for processing exists under the DPA. The following table summarizes ph956's processing activities, their purposes, and the applicable legal basis under Section 12 of the DPA:

6.1 General Principle. ph956 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. Data sharing is limited to what is necessary for the provision of the Platform's services, regulatory compliance, and the protection of ph956's legitimate interests.

6.2 Categories of Recipients. ph956 may share your personal data with the following categories of third parties:

• PAGCOR and Philippine Government Authorities: ph956 is legally required to disclose player data to PAGCOR as part of its licensing obligations, and to the Anti-Money Laundering Council (AMLC), Bureau of Internal Revenue (BIR), Philippine National Police (PNP), or other competent authorities upon lawful request or legal obligation.
• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other approved Philippine payment service providers receive the minimum personal and financial data necessary to process your deposit and withdrawal transactions.
• KYC and Identity Verification Providers: Third-party identity verification services engaged by ph956 to perform age verification and identity checks as mandated by PAGCOR regulations. These providers are contractually bound to use your data solely for the purpose of KYC verification on ph956's behalf.
• Fraud Prevention and Security Services: Third-party fraud detection and cybersecurity service providers who assist ph956 in detecting unauthorized access, financial fraud, and multi-account abuse.
• Game Software Providers: Game providers (such as Pragmatic Play, PG Soft, and Evolution Gaming) may receive technical session identifiers required for the delivery of their games within the ph956 platform. These providers do not receive your name, financial data, or government ID information.
• Professional Advisers: Legal counsel, auditors, accountants, and insurers retained by ph956, subject to confidentiality obligations.

6.3 Business Transfers. In the event of a merger, acquisition, restructuring, or sale of ph956's business or assets, your personal data may be disclosed to the prospective buyer and their advisers as part of due diligence, subject to confidentiality obligations. You will be notified if your personal data is to be transferred to a new data controller as a result of such a transaction.

6.4 No Unauthorized Disclosure. ph956 will not disclose your personal data to any third party other than those identified above without your explicit prior consent, except where disclosure is required by applicable Philippine law or a binding order from a competent Philippine court or regulatory authority.

7.1 Retention Periods. ph956 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following indicative retention periods apply:

• Account and KYC Records: Retained for a minimum of five (5) years following account closure, in compliance with PAGCOR licensing requirements and the DPA.
• Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in compliance with the Anti-Money Laundering Act (AMLA) and BIR requirements.
• Gameplay Records: Retained for a minimum of three (3) years for responsible gaming, dispute resolution, and audit purposes.
• Marketing Consent Records: Retained for the duration of your account and for three (3) years after account closure, for compliance demonstration purposes.
• Support Communications: Retained for three (3) years from the date of each interaction.
• Technical and Log Data: Retained for twelve (12) months, after which it is anonymized or deleted.

7.2 Post-Retention Deletion. Upon expiry of the applicable retention period, ph956 will securely delete or irreversibly anonymize your personal data, subject to any ongoing legal proceedings or regulatory investigations that require continued retention.

8.1 Technical Safeguards. ph956 implements the following technical security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and ph956's servers.
• AES-256 encryption at rest for sensitive personal data, including KYC documents and financial identifiers stored in ph956's databases.
• Tokenization of payment account identifiers — full GCash numbers and bank account numbers are never stored in retrievable plain text.
• Multi-factor authentication (MFA) required for all ph956 administrative system access.
• Intrusion detection systems (IDS) and continuous 24/7 security monitoring of ph956's infrastructure.
• Regular third-party penetration testing and security audits of the Platform.

8.2 Organizational Safeguards. Access to personal data within ph956 is restricted on a strict need-to-know basis. All ph956 employees and contractors with access to personal data are subject to confidentiality obligations and receive mandatory data privacy training aligned with DPA requirements.

8.3 Data Breach Notification. In the event of a personal data breach that is likely to result in significant harm to affected data subjects, ph956 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular No. 16-03. Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

9.1 What Are Cookies. Cookies are small text files placed on your device by ph956's Platform when you visit the Website. ph956 uses cookies and similar tracking technologies (including web beacons and local storage) to deliver and improve the Platform's functionality, analyze usage patterns, and support security and fraud prevention systems.

9.2 Types of Cookies Used by ph956:

• Strictly Necessary Cookies: session_token, auth_state, csrf_token — Required for the Platform to function. These cannot be disabled without preventing Platform use. No consent is required for these cookies under applicable Philippine law.
• Functional Cookies: ui_preferences, lang_setting, last_game — Used to remember your account preferences and recent activity to improve your experience.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players navigate the Platform, which pages are most visited, and where usability issues occur. This data is used solely to improve the Platform.
• Security Cookies: device_fingerprint, fraud_check — Used to detect suspicious login attempts, multi-account activity, and bot access in support of ph956's fraud prevention obligations.

9.3 Managing Cookies. You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, disabling strictly necessary cookies will prevent you from logging into your ph956 account and using the Platform. Instructions for managing cookies are available in your browser's help documentation.

10.1 Opt-In Basis. ph956 sends promotional communications — including bonus offers, new game announcements, and tournament invitations — only to players who have provided explicit consent to receive such communications during registration or through their Account Settings. Marketing communications are not sent as a condition of account registration.

10.2 Channels. Marketing communications from ph956 may be delivered via SMS to your registered Philippine mobile number, email to your registered address, and in-platform notifications when you are logged into your ph956 account.

10.3 Opting Out. You may withdraw your consent to receive marketing communications at any time by: (a) updating your notification preferences in Account Settings; (b) clicking the unsubscribe link in any ph956 marketing email; or (c) sending a request to ph956's support team via live chat or email. Opt-out requests are processed within 72 hours. Withdrawal of marketing consent does not affect your account functionality or gaming access.

10.4 Service Notifications. ph956 may send you non-marketing service notifications — such as account security alerts, deposit confirmations, withdrawal notifications, KYC request notices, and responsible gaming reminders — regardless of your marketing preferences. These are essential service communications required for account management and cannot be disabled while your account is active.

11.1 Minimum Age. ph956 Casino is strictly for persons aged 21 years and above, in compliance with PAGCOR's regulations governing online gambling in the Philippines. ph956 does not knowingly collect or process personal data of individuals below 21 years of age.

11.2 Age Verification Obligations. As part of KYC compliance, ph956 requires verification of date of birth before processing any withdrawal. Accounts where the age of the registered user cannot be verified as 21+ will be suspended and all balances held pending verification or, where the user is confirmed to be underage, returned to the originating payment method.

11.3 Discovery of Underage Data. If ph956 discovers that personal data has been collected from an individual below 21 years of age, ph956 will immediately suspend the associated account, delete the collected personal data to the extent permitted by applicable law, and return any deposited funds to the originating Philippine payment method.

12.1 How to Submit a Request. To exercise any of the data rights described at the beginning of this Policy, you may contact ph956's Data Protection Officer using the contact details in Section 15. Requests should include your full name, registered email address, registered Philippine mobile number, and a clear description of the right you wish to exercise.

12.2 Identity Verification. For the protection of your personal data, ph956 will verify your identity before processing any data rights request. This typically involves confirming your registered contact details and may require provision of a government-issued ID for high-sensitivity requests (such as data erasure or account closure).

12.3 Response Timelines. ph956 will respond to verified data rights requests within fifteen (15) business days. For complex or voluminous requests, ph956 may extend this period by a further fifteen (15) business days, provided you are notified of the extension and the reasons for it within the initial 15-day period.

12.4 Complaints to the NPC. If you believe ph956 has not adequately addressed your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the competent supervisory authority for data protection matters in the Republic of the Philippines.

13.1 Primary Processing Location. ph956's primary data processing infrastructure is located within or in connection with the Philippines. The majority of personal data processing activities take place on servers operating under Philippine jurisdiction.

13.2 Third-Party Service Providers. Certain third-party service providers engaged by ph956 (such as international game software providers and cloud infrastructure partners) may process limited categories of technical data outside the Philippines. Where such transfers occur, ph956 ensures that appropriate safeguards are in place in accordance with Section 21 of the DPA and NPC issuances on cross-border data transfers, including contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under Philippine law.

13.3 Financial Data. Personal financial data related to GCash, PayMaya, and Philippine bank transfers is processed exclusively through Philippine-domiciled payment processors and does not leave Philippine data processing jurisdiction.

14.1 Right to Update. ph956 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or the services we provide. The "Last Updated" date at the top of this Policy will be revised accordingly upon any amendment.

14.2 Notification of Material Changes. For material changes to this Policy — meaning changes that significantly affect your rights or the way ph956 processes your personal data — ph956 will provide notice to registered users via email to your registered address and/or in-platform notification at least fourteen (14) days before the changes take effect.

14.3 Continued Use as Acceptance. Your continued use of the ph956 Platform following the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the revised Privacy Policy, you must cease using the Platform and may request account closure in accordance with the account termination provisions in ph956's Terms & Conditions.

14.4 Archived Versions. Previous versions of this Privacy Policy are retained by ph956 for internal reference. Users who require access to a prior version for dispute resolution purposes may request it by contacting the Data Protection Officer.

For all data privacy matters — including exercising your data rights, submitting a data breach concern, or making a complaint — please contact ph956 through the following channels: