Overview and Scope
This Privacy Policy ("Policy") describes how ph188 ("we," "us," "our") collects, uses, discloses, and safeguards personal information about you when you access or use the ph188 online gaming platform available at ph188.one ("Platform"), including all associated games, payment services, customer support channels, and promotional activities.
This Policy applies to all users of the ph188 Platform, including registered players, visitors who browse without registering, and individuals who contact ph188's support team. It covers personal data processed by ph188 in connection with the Platform, regardless of the device or channel used to access it.
This Policy is issued pursuant to the requirements of Republic Act No. 10173, known as the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as well as applicable circulars and guidelines issued by the National Privacy Commission of the Philippines. ph188 operates the Platform in compliance with its obligations as a PAGCOR-regulated gaming operator, which includes specific data handling requirements mandated by PAGCOR.
Identity of the Data Controller
For the purposes of the Data Privacy Act of 2012, ph188 — the operator of ph188.one — is the Personal Information Controller responsible for the personal data collected through the Platform. ph188 determines the purposes and means of processing personal data in connection with the delivery of its gaming services.
Where ph188 engages third-party service providers to process personal data on its behalf (such as payment processors or fraud detection services), those entities act as Personal Information Processors under the DPA and are contractually bound to process data only in accordance with ph188's instructions and applicable law.
ph188 has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance across the Platform. Contact details for the DPO are provided in Section 15 of this Policy.
Categories of Personal Data We Collect
ph188 collects the following categories of personal data in connection with the operation of the Platform. All collection is done with transparency and only to the extent necessary for the stated purposes:
How We Collect Your Personal Data
ph188 collects personal data through the following means:
Direct Collection
You provide personal data directly to ph188 when you: (a) register for a ph188 account; (b) complete KYC identity verification; (c) make a deposit or withdrawal; (d) claim a bonus or participate in a promotion; (e) contact our customer support team via Live Chat or email; (f) update your account profile or settings.
Automated Collection
When you access the ph188 Platform, certain technical and behavioral data is collected automatically through server logs, session tracking technologies, and analytics tools. This includes your IP address, device identifiers, browser configuration, and navigation behavior on the Platform. This data helps ph188 maintain platform security, detect fraud, and improve the user experience.
Third-Party Sources
ph188 may receive personal data about you from third parties in the following circumstances: (a) identity verification service providers conducting KYC checks; (b) payment processors confirming transaction authenticity; (c) fraud prevention and anti-money laundering screening services; (d) PAGCOR or other regulatory authorities, where required by law.
Purposes of Processing
ph188 processes your personal data for the following purposes:
- Account Registration and Management — to create and maintain your ph188 account, verify your identity and age, and manage your account settings and preferences.
- Service Delivery — to provide access to games, process bets, award winnings, and deliver all gaming services available on the Platform.
- Payment Processing — to process deposits and withdrawals via GCash, PayMaya, and banking channels, and to maintain accurate financial records of all transactions.
- KYC and Anti-Money Laundering (AML) Compliance — to verify player identity and source of funds in compliance with PAGCOR's KYC requirements and the Anti-Money Laundering Act (R.A. 9160, as amended).
- Fraud Prevention and Security — to detect, investigate, and prevent fraudulent transactions, unauthorized account access, and platform abuse.
- Responsible Gaming — to monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, and comply with PAGCOR responsible gaming requirements.
- Customer Support — to respond to inquiries, resolve disputes, and provide technical assistance to ph188 players.
- Legal and Regulatory Compliance — to comply with applicable Philippine law, PAGCOR directives, court orders, and reporting obligations to regulatory authorities.
- Platform Improvement — to analyze platform usage patterns, improve game offerings, optimize the user interface, and personalize the gaming experience.
- Marketing and Promotions — to send promotional communications about ph188 offers, subject to your marketing preferences and opt-out rights.
Legal Basis for Processing
Under the Data Privacy Act of 2012, ph188 processes your personal data on the following legal grounds, as applicable to each purpose:
- Consent (Section 12(a) DPA) — For marketing communications and optional personalization features, ph188 relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
- Contractual Necessity (Section 12(b) DPA) — Processing necessary for the performance of our agreement with you, including account creation, game delivery, payment processing, and customer support.
- Legal Obligation (Section 12(c) DPA) — Processing required to comply with applicable law, including PAGCOR regulations, the Anti-Money Laundering Act, and the Data Privacy Act itself.
- Legitimate Interests (Section 12(f) DPA) — Processing necessary for ph188's legitimate interests, such as fraud prevention, platform security, analytics, and responsible gaming monitoring, provided such interests are not overridden by your rights and interests.
Disclosure and Data Sharing
ph188 does not sell your personal data to any third party. We may share personal data with the following categories of recipients, strictly for the purposes described in this Policy:
Payment Service Providers
GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency wallet providers receive transactional data necessary to process your deposits and withdrawals. These providers are subject to their own privacy policies and applicable financial regulations in the Philippines.
Identity Verification Partners
Third-party KYC and identity verification providers may receive your identity documents and biometric data for the purpose of fulfilling PAGCOR's KYC requirements. All such providers are contractually bound to process data solely for verification purposes and in accordance with the DPA.
Fraud Prevention and AML Services
ph188 works with fraud prevention and anti-money laundering screening platforms that may receive transactional and identity data to perform risk assessments. These services are engaged on the basis of ph188's legal obligations under PAGCOR regulations and applicable AML law.
Regulatory Authorities
PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government authorities may receive player data as required by law, including in response to lawful orders, regulatory examinations, or investigation requests.
Technology and Platform Providers
Cloud hosting, analytics, game platform, and customer support software providers may process personal data on ph188's behalf as Personal Information Processors. All such providers are governed by Data Processing Agreements requiring compliance with the DPA and ph188's security standards.
Data Retention
ph188 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law and PAGCOR regulations. The following general retention periods apply:
- Account Data — retained for the duration of your active account and for a period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements.
- Financial Transaction Data — retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act and PAGCOR financial reporting obligations.
- KYC Documentation — retained for the duration of the account and for five (5) years post-closure, or longer if required by active regulatory proceedings.
- Customer Support Communications — retained for two (2) years from the date of the last communication, unless the matter is subject to ongoing dispute or legal proceedings.
- Gaming Activity Logs — retained for five (5) years for regulatory audit and responsible gaming monitoring purposes.
- Technical and Behavioral Data — retained for up to twelve (12) months for security, analytics, and platform improvement purposes, after which data is aggregated or anonymized.
Upon expiration of applicable retention periods, personal data is securely deleted or irreversibly anonymized such that you can no longer be identified from the remaining data.
Your Data Subject Rights
As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ph188. You may exercise any of these rights by contacting our Data Protection Officer using the details in Section 15.
Right to Access
Request a copy of the personal data ph188 holds about you and information about how it is used.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your ph188 account.
Right to Erasure
Request deletion of your personal data where it is no longer necessary, subject to legal retention obligations.
Right to Object
Object to processing based on legitimate interests, including direct marketing activities.
Right to Block or Restrict
Request restriction of processing while a dispute about accuracy or lawfulness is resolved.
Right to Portability
Receive your personal data in a structured, machine-readable format for transfer to another service.
Right to Complain
Lodge a complaint with the National Privacy Commission if you believe your data rights have been violated.
Right to Withdraw Consent
Withdraw consent to marketing or optional processing at any time, without affecting prior lawful processing.
ph188 will respond to verified data subject requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior written notice. ph188 reserves the right to request identity verification before acting on data subject requests, to prevent unauthorized disclosure.
Security Measures
ph188 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security program includes:
- Encryption in Transit — all data transmitted between your device and ph188's servers is encrypted using TLS (Transport Layer Security) protocol;
- Encryption at Rest — sensitive personal data stored on ph188's systems is encrypted using AES-256 or equivalent industry-standard encryption;
- Access Controls — access to personal data is restricted to authorized ph188 personnel whose roles require such access, governed by role-based access controls and the principle of least privilege;
- Audit Logging — access to and operations performed on personal data are logged and monitored for anomalous activity;
- Penetration Testing — ph188's systems undergo regular security assessments and penetration testing by qualified security professionals;
- Employee Training — all ph188 personnel handling personal data receive mandatory data privacy and security training;
- Incident Response — ph188 maintains a documented data breach response procedure compliant with NPC notification requirements under the DPA.
Cookies and Tracking Technologies
ph188 uses cookies and similar technologies on the Platform to enable core functionality, measure performance, and improve the user experience. The following categories of cookies are used:
- Strictly Necessary Cookies — essential for the Platform to function, including session management, authentication, and security. These cannot be disabled without impairing Platform functionality.
- Performance and Analytics Cookies — used to measure how players interact with the Platform, identify popular features, and detect errors. Data collected is aggregated and not used to identify individuals.
- Functional Cookies — used to remember your preferences (e.g., preferred language, game lobby view) to provide a more personalized experience.
ph188 does not use third-party advertising or behavioural targeting cookies. No cookie data collected on ph188 is shared with ad networks or social media platforms for advertising purposes.
You may manage or disable non-essential cookies through your browser settings. Disabling strictly necessary cookies may impair your ability to log in or use certain Platform features.
Minors and Age Restriction
ph188 is strictly intended for individuals aged 21 years and above, in accordance with PAGCOR regulations governing online gaming in the Philippines. ph188 does not knowingly collect personal data from any person under 21 years of age.
Age verification is conducted during registration and as part of the KYC process. Where ph188 discovers, at any point, that a registered player is under 21 years of age, the account will be immediately suspended, all gameplay data will be reviewed, any deposits will be refunded, and the matter will be referred to PAGCOR as required by regulation.
Cross-Border Data Transfers
ph188's primary data processing infrastructure is located within the Philippines. However, certain third-party service providers engaged by ph188 — including cloud hosting, game platform, and analytics providers — may be headquartered or operate data centres in jurisdictions outside the Philippines.
Where personal data is transferred outside the Philippines, ph188 ensures that such transfers are carried out in compliance with the Data Privacy Act and applicable NPC guidelines. Specifically, ph188 requires that all cross-border transfers meet at least one of the following conditions:
- The recipient country has been assessed to provide an adequate level of protection for personal data under Philippine law;
- Appropriate safeguards are in place, such as binding contractual clauses (Data Processing Agreements) requiring the recipient to maintain standards at least equivalent to the DPA;
- The transfer is necessary for the performance of ph188's contractual obligations to you; or
- You have provided explicit prior consent to the specific transfer.
ph188 maintains a current record of all cross-border data transfers and associated safeguards, available to the NPC upon request.
Amendments to This Policy
ph188 may update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, platform features, or our data processing practices. The "Effective Date" at the top of this Policy will be updated whenever material changes are made.
When material changes are made to this Policy, ph188 will provide notice to registered players via a prominent notification displayed on the Platform and, where appropriate, by email to your registered address. We encourage you to review this Policy periodically to remain informed about how ph188 protects your personal data.
Your continued use of the ph188 Platform following notification of Policy amendments constitutes your acknowledgment of the updated terms. If you do not accept the amended Policy, you may request account closure in accordance with our Terms & Conditions.
Contact Information and Data Protection Officer
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ph188, please contact our Data Protection Officer or Customer Support team through the channels below.
ph188 is committed to resolving privacy concerns fairly and in compliance with the Data Privacy Act. We take all DPO inquiries and NPC complaints seriously and will cooperate fully with any regulatory inquiry.