phataya Privacy Policy

phataya ("we," "us," "our") operates the online gaming platform at phataya.vip and is committed to protecting the personal data of all players registered on our platform. This Privacy Policy ("Policy") describes our practices with respect to the collection, use, storage, disclosure, and protection of personal information provided by or collected from users ("Player," "you," "your") of the phataya Platform.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines, and its Implementing Rules and Regulations (IRR) as promulgated by the National Privacy Commission (NPC). It is also consistent with the requirements of the Philippine Amusement and Gaming Corporation (PAGCOR) under phataya's operating license.

By registering an account on phataya, using any feature of the Platform, or otherwise interacting with phataya's services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal information as described herein. If you do not agree, you must discontinue use of the Platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, phataya is the Personal Information Controller (PIC) in respect of all personal data processed in connection with your use of the phataya Platform. As PIC, phataya determines the purpose and means by which your personal data is processed.

phataya has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with data privacy obligations, managing data subject rights requests, and serving as the primary point of contact for data privacy matters. Contact details for the DPO are provided in Section 14 of this Policy.

phataya collects personal data in the following categories, depending on the nature of your interaction with the Platform:

3.1 Registration and Identity Data

• Full legal name (as it appears on your Philippine government-issued ID)
• Date of birth (for age verification — 21+ requirement)
• Active Philippine mobile number (used as primary account identifier and OTP delivery)
• Username or account alias
• Account password (stored as a one-way cryptographic hash — phataya does not store plain-text passwords)

3.2 Identity Verification (KYC) Data

• Scanned or photographed copy of a valid Philippine government-issued identification document (PhilSys, UMID, driver's license, or passport)
• Proof of address (where additionally required)
• Source of funds documentation (where required for AML compliance)
• Selfie or facial image for document liveness verification (where applicable)

3.3 Financial and Transaction Data

• Deposit history (amount, payment method, timestamp, transaction reference)
• Withdrawal history and destination payment account identifiers (GCash number, bank account last digits)
• Wallet balance history
• Bonus and promotional transaction records

3.4 Gaming Activity Data

• Game session history (game title, session duration, bets placed, outcomes, winnings)
• Responsible gaming tool settings (deposit limits, loss limits, session reminders, self-exclusion status)
• Bonus wagering progress records

3.5 Technical and Usage Data

• IP address at time of registration and login
• Device type, operating system, and browser version
• Mobile network operator (for Philippine SIM-linked accounts)
• Session timestamps, page views, and navigation patterns within the Platform
• Error and crash logs relevant to your session

3.6 Communications Data

• Live chat transcripts with phataya support agents
• Email correspondence sent to phataya support channels
• Records of SMS notifications and OTP delivery confirmations

phataya collects personal data through the following means:

• Directly from you: When you register an account, complete KYC, make a deposit or withdrawal request, contact support, or update your account settings.
• Automatically: When you access and use the Platform — device data, session data, and usage logs are collected automatically through server-side logging and session management systems.
• From payment processors: When you initiate a GCash, Maya, BPI, BDO, or other payment transaction, the payment processor shares transaction confirmation data with phataya necessary to credit or debit your Wallet.
• From identity verification partners: Where phataya uses a third-party KYC verification service, that service provider shares the results of document verification checks with phataya as required to complete account verification.
• From cookies and tracking technologies: As described in Section 9 of this Policy.

The following table summarises the primary purposes for which phataya processes your personal data and the legal basis under the Data Privacy Act for each processing activity:

phataya does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. Personal data may be shared with the following categories of recipients only where necessary and under appropriate data sharing agreements or legal obligations:

6.1 Payment Processing Partners

GCash (G-Xchange, Inc.), Maya (Paymaya Philippines, Inc.), BPI, BDO, Metrobank, GrabPay, and other payment service providers receive transaction-relevant personal data solely for the purpose of executing and confirming deposit and withdrawal transactions. These providers are independent data controllers under their own privacy policies.

6.2 Identity Verification and KYC Service Providers

Where phataya uses a third-party KYC platform to conduct document verification, that provider processes identity document data under a data processing agreement with phataya and is prohibited from using that data for any other purpose.

6.3 Game Content Providers

Third-party game studios (such as Pragmatic Play, PG Soft, and Jili Games) receive session-specific data necessary to deliver their games within the phataya Platform — typically limited to a pseudonymous player session identifier, stake amount, and game result. These providers do not receive your name, mobile number, or payment details.

6.4 Regulatory and Law Enforcement Authorities

phataya is required by law to share personal data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities where required by applicable law, a court order, or a valid regulatory demand. phataya will notify affected players of such disclosures where legally permitted to do so.

6.5 Corporate Group and Service Providers

Personal data may be shared with phataya's affiliated entities and contracted service providers (such as cloud hosting providers, fraud detection vendors, and customer support platform operators) strictly for the purpose of operating the Platform. All such service providers are bound by data processing agreements that restrict use of personal data to the specified purpose.

phataya retains personal data for as long as necessary to fulfil the purpose for which it was collected, and in any case for the minimum period required by applicable Philippine law. The following general retention periods apply:

• Account and registration data: Retained for the duration of the active account relationship plus five (5) years following account closure, in compliance with PAGCOR record-keeping requirements.
• KYC and identity verification documents: Retained for five (5) years following account closure or the conclusion of any investigation in which the documents are relevant, in compliance with AML record-keeping requirements under R.A. 9160.
• Financial transaction records: Retained for ten (10) years in compliance with Anti-Money Laundering Act requirements.
• Gaming session records: Retained for five (5) years following account closure.
• Customer support communications: Retained for three (3) years from the date of the relevant interaction.
• Marketing consent records: Retained for three (3) years from the date of opt-in or until consent is withdrawn, whichever is earlier.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Where anonymised, the resulting data may be retained indefinitely for statistical and analytical purposes.

phataya implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:

• Encryption in transit: All data transmitted between your device and phataya's servers is encrypted using TLS (Transport Layer Security) 1.2 or higher.
• Encryption at rest: Personal data stored in phataya's databases, including KYC documents and financial records, is encrypted at rest using AES-256 or equivalent standards.
• Access controls: Access to personal data is restricted to authorised personnel based on the principle of least privilege. All access is logged and subject to regular audit.
• Password security: Account passwords are stored as one-way cryptographic hashes using industry-standard algorithms. Plain-text passwords are never stored or transmitted.
• Two-factor authentication: phataya offers and encourages two-factor authentication (2FA) via SMS OTP for all player account logins.
• Vulnerability management: phataya conducts regular security assessments and vulnerability scans of its Platform infrastructure.
• Staff training: All phataya personnel with access to personal data receive regular data privacy and security training.

phataya uses cookies and similar web tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during an active session, and security cookies that help detect and prevent fraudulent login attempts. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences such as language selection, game lobby view settings, and notification preferences. These improve your experience but are not essential for basic Platform use.
• Analytics cookies: Collect anonymised data about how players navigate the Platform — which pages are visited, where users encounter errors, and how long sessions last. This data helps phataya improve the Platform. Analytics data is processed in aggregate and is not used to identify individual players.
• Performance cookies: Help phataya identify and resolve technical issues, including slow page loads, broken game launches, and payment flow errors.

phataya does not use third-party advertising cookies or allow third-party ad networks to place tracking technologies on the Platform.

Most web browsers allow you to control cookies through browser settings. Blocking all cookies will prevent Platform login and is not recommended. Blocking functional or analytics cookies only will not affect your ability to play games or make transactions.

Under the Data Privacy Act of 2012 (R.A. 10173), you have the following rights with respect to your personal data held by phataya. To exercise any of these rights, contact phataya's Data Protection Officer using the details in Section 14.

• Right to be informed: You have the right to be informed about how your personal data is being collected, processed, and used — which is the purpose of this Policy.
• Right of access: You have the right to request a copy of the personal data phataya holds about you, along with information about how it is used.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data held by phataya.
• Right to erasure or blocking: You have the right to request deletion or blocking of your personal data where it is no longer necessary for the purpose for which it was collected, subject to phataya's legal retention obligations.
• Right to object: You have the right to object to processing of your personal data based on phataya's legitimate interest, including profiling for marketing purposes.
• Right to data portability: You have the right to receive a copy of personal data you have provided to phataya in a commonly used, machine-readable format.
• Right to damages: You have the right to claim compensation for damages sustained as a result of a violation of the Data Privacy Act by phataya.
• Right to file a complaint: If you believe phataya has violated your data privacy rights, you may file a complaint with the National Privacy Commission (NPC) of the Philippines.

phataya's Platform is strictly restricted to persons aged 21 years and above in compliance with PAGCOR's licensing requirements. phataya does not knowingly collect personal data from individuals under 21 years of age. Age is verified during account registration and through the KYC process.

In the event phataya discovers that personal data has been collected from an individual under the age of 21 — whether through misrepresentation, falsified documents, or any other means — phataya will immediately close the relevant account, delete all associated personal data to the extent permitted by law, and retain only the records necessary to report the incident to PAGCOR as required.

If you are a parent or guardian and believe that a minor in your care has created a phataya account, please contact our support team or Data Protection Officer immediately. We take underage access seriously and will act promptly on all verified reports.

phataya's primary data processing infrastructure is located within or proximate to the Philippines. In some cases, personal data may be transferred to or processed by service providers located outside the Philippines — for example, where a game content provider's servers are located in another jurisdiction.

Where personal data is transferred outside the Philippines, phataya ensures that appropriate safeguards are in place to protect your data to at least the same standard as required by the Data Privacy Act of 2012. Such safeguards include contractual data processing agreements that bind the recipient to data protection obligations consistent with Philippine requirements.

By using the phataya Platform and agreeing to this Privacy Policy, you consent to such cross-border transfers where they are necessary for the operation of the Platform services you have requested.

phataya may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or Platform features. The revised Policy will be published on this page with an updated effective date. Where changes are material — meaning they substantially affect how we collect, use, or share your personal data — phataya will notify registered Players via their registered mobile number or other contact details on file before the changes take effect.

Your continued use of the phataya Platform following the publication of any update to this Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the updated Policy, you must discontinue use of the Platform and may request account closure in accordance with the process described in phataya's Terms and Conditions.

phataya's Data Protection Officer (DPO) is responsible for overseeing this Privacy Policy and for managing data subject rights requests. You may contact the phataya DPO through the following channels:

• Live Chat: Available 24/7 via the phataya Platform interface — request to speak with a Data Privacy representative.
• Email (plain text — not a clickable link): support@phataya.vip — please include "Data Privacy Request" in the subject line.

When submitting a data subject rights request, please include your full registered name, your registered Philippine mobile number, a description of the right you wish to exercise, and a copy of a valid Philippine government-issued ID for identity verification purposes. phataya will not process data requests where the identity of the requester cannot be verified.