phmanalo Privacy Policy

1. Who We Are & Scope of This Policy

phmanalo ("phmanalo," "we," "us," or "our") operates the online gaming platform available at phmanalo.org ("the Platform"). phmanalo is regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and is committed to protecting the personal data of every player, visitor, and prospective customer in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations ("IRR"), overseen by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy applies to all personal data collected through phmanalo.org, its associated mobile-optimised web pages, customer support channels, email communications, and any other touchpoint where phmanalo acts as a Personal Information Controller ("PIC") as defined under the DPA. It does not cover third-party websites or services that may be linked from or integrated with the Platform, which are governed by their own privacy policies.

By creating an account or otherwise using the phmanalo Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Personal Data We Collect

phmanalo collects the following categories of personal data:

phmanalo does not knowingly collect biometric data beyond what is inherent in KYC document photographs submitted for identity verification.

3. How We Collect Your Data

phmanalo collects personal data through the following means:

• Direct Collection: When you complete the registration form, submit KYC documents, contact customer support, or update your account profile on the phmanalo Platform.
• Automated Collection: When you visit or use the Platform, phmanalo's servers automatically record Technical Data including your IP address, browser type, pages visited, click paths, and session duration through cookies and server logs.
• Third-Party Sources: phmanalo may receive identity verification results from licensed KYC service providers, fraud detection signals from payment processors, and age verification outcomes from PAGCOR-compliant verification services. These third parties are contractually bound to handle your data in compliance with Philippine law.
• Payment Providers: When you deposit or withdraw via GCash, PayMaya, BPI, BDO, or other linked payment methods, transaction confirmation data is shared with phmanalo by those providers to reconcile your account balance.

4. Purposes & Legal Bases for Processing

phmanalo processes your personal data only for the purposes listed below, each of which has a corresponding lawful basis under the DPA:

• Account Creation & Management: To create, maintain, and secure your phmanalo account — lawful basis: performance of a contract.
• Identity & Age Verification (KYC): To comply with PAGCOR KYC requirements and verify that you are 21 or older — lawful basis: compliance with a legal obligation.
• Payment Processing: To process deposits and withdrawals via GCash, PayMaya, and bank channels — lawful basis: performance of a contract.
• Anti-Money Laundering (AML) Compliance: To monitor transactions for suspicious activity as required by the Anti-Money Laundering Act (RA 9160, as amended) — lawful basis: compliance with a legal obligation.
• Customer Support: To respond to enquiries, resolve disputes, and maintain support records — lawful basis: legitimate interests.
• Responsible Gaming: To monitor gaming behaviour and enforce deposit limits, session limits, and self-exclusion orders — lawful basis: compliance with a legal obligation / legitimate interests.
• Platform Security & Fraud Prevention: To detect and prevent unauthorised access, bot activity, multi-accounting, and fraud — lawful basis: legitimate interests.
• Marketing Communications: To send promotional offers and bonus notifications — lawful basis: consent. You may withdraw marketing consent at any time through your phmanalo account settings.
• Analytics & Product Improvement: To understand how players use phmanalo and improve the Platform's features and performance — lawful basis: legitimate interests.

5. Sharing & Disclosure of Personal Data

phmanalo does not sell or rent your personal data to any third party. We share your data only in the following circumstances:

• PAGCOR & Regulatory Authorities: phmanalo is legally obligated to disclose player data to PAGCOR upon request and to the Anti-Money Laundering Council (AMLC) and other Philippine government agencies where required by law.
• Payment Service Providers: We share necessary financial data with GCash (Mynt), PayMaya (Maya Philippines, Inc.), BPI, BDO, Metrobank, and other payment partners solely for transaction processing purposes. These providers are bound by their own DPA-compliant privacy policies.
• KYC & Fraud Verification Providers: Identity document images and verification results are shared with licensed third-party KYC providers under data processing agreements that meet NPC standards.
• Game Software Providers: Anonymised gaming activity data may be shared with certified game studios for game performance analytics and fair play auditing purposes. No personally identifiable information is shared without your consent.
• Law Enforcement: phmanalo will disclose personal data to law enforcement authorities in the Philippines where required by a valid court order or where disclosure is necessary to prevent imminent harm.
• Corporate Transactions: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

6. International Transfers

phmanalo's primary data processing infrastructure is hosted in data centres located within or near the Philippines. Where data is transferred to processors outside the Philippines — for example, internationally based game studios or cloud infrastructure providers — phmanalo ensures that such transfers are made only:

• To countries or organisations that the NPC has determined provide an adequate level of data protection; or
• Under contractual arrangements that impose data protection obligations equivalent to those under Philippine law.

You may request details of the specific safeguards in place for any international transfers by contacting phmanalo's Data Protection Officer at the contact details in Section 14.

7. Data Retention

phmanalo retains your personal data for as long as your account is active and for such additional periods as are required by law or legitimate business purposes:

• Account & KYC Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, as required by PAGCOR and AMLC record-keeping obligations.
• Transaction Records: Retained for a minimum of five (5) years in compliance with AML legislation.
• Gaming Activity Logs: Retained for three (3) years following the relevant gaming session.
• Marketing Preferences: Retained until you withdraw consent or close your account, plus six (6) months to process the withdrawal.
• Technical & Session Logs: Retained for up to ninety (90) days for security and fraud detection purposes.

Once the applicable retention period has expired, phmanalo securely destroys or anonymises personal data in accordance with NPC guidelines.

8. Cookies & Tracking Technologies

phmanalo uses cookies and similar tracking technologies on the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function — for example, session authentication tokens that keep you logged in to phmanalo. These cannot be disabled.
• Performance & Analytics Cookies: Collect anonymised data on how visitors use the phmanalo Platform (pages visited, session length, error reports) to help us improve the user experience.
• Functional Cookies: Remember your preferences, such as language settings and preferred payment method.
• Marketing Cookies: Used to show you relevant phmanalo promotions and to measure the effectiveness of marketing campaigns. These are only set with your consent.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the phmanalo Platform, though some features may be affected.

9. Security Measures

phmanalo implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. Key measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and phmanalo's servers;
• Encryption at rest for sensitive personal and financial data stored in phmanalo databases;
• Role-based access controls ensuring that only authorised phmanalo personnel can access player data, on a need-to-know basis;
• Two-factor authentication (2FA) support for phmanalo player accounts;
• Regular penetration testing and security audits of the Platform by independent security professionals;
• Intrusion detection and real-time monitoring for anomalous login or transaction activity;
• Staff data protection training and binding confidentiality obligations.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to affect your rights, phmanalo will notify the NPC within seventy-two (72) hours and affected players without undue delay, as required by the DPA.

10. Your Rights Under the DPA

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmanalo:

• Right to be Informed: The right to know what personal data phmanalo collects, why, and how it is used — fulfilled by this Privacy Policy.
• Right of Access: The right to request a copy of the personal data phmanalo holds about you.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected.
• Right to Erasure / Blocking: The right to request deletion or blocking of personal data that is no longer necessary, was unlawfully processed, or was collected on the basis of consent that you have since withdrawn — subject to phmanalo's legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interests, in particular for direct marketing purposes.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format for transfer to another controller.
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe phmanalo has violated your data privacy rights.

To exercise any of the above rights, contact phmanalo's Data Protection Officer using the details in Section 14. phmanalo will respond to verified requests within thirty (30) days.

11. Children's Privacy & Age Verification

phmanalo strictly prohibits the use of its Platform by persons under 21 years of age, in accordance with PAGCOR regulations applicable to casino-style gaming in the Philippines. phmanalo does not knowingly collect or process personal data from persons under 21.

If phmanalo becomes aware that personal data has been collected from a person under 21, the relevant account will be immediately suspended, all data will be securely deleted, and the matter will be reported to PAGCOR. phmanalo applies KYC age verification to all accounts prior to authorising withdrawals.

If you are a parent or guardian and believe a person under 21 has registered an account on phmanalo, please contact our Data Protection Officer immediately using the details in Section 14.

12. Responsible Gaming & Data

phmanalo uses gaming activity data and account behaviour data to support responsible gaming obligations under PAGCOR requirements. Specifically, this data is used to:

• Monitor for patterns that may indicate problem gambling behaviour;
• Enforce deposit limits, session time limits, and self-exclusion periods set by the Player;
• Process and maintain self-exclusion records in compliance with PAGCOR's responsible gaming framework;
• Share self-exclusion status with the PAGCOR national exclusion registry where required.

Self-exclusion status is treated as Sensitive Personal Information and is subject to the highest level of access control within phmanalo's systems. For more information on phmanalo's responsible gaming tools, please visit our Responsible Gaming page.

13. Amendments to This Policy

phmanalo reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulations, NPC guidance, or phmanalo's data processing practices. Material changes will be communicated to registered Players via email or in-platform notification at least seven (7) days before taking effect.

The date of the most recent update is displayed at the top of this page. Continued use of the phmanalo Platform following any amendment constitutes your acceptance of the revised Privacy Policy.

14. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or phmanalo's processing of your personal data, please contact our Data Protection Officer (DPO):

• Email (plain text — not a link): [email protected]
• Subject line: "Privacy / DPO Request – [Your Account Username]"
• Live Chat: Available 24/7 through the phmanalo Platform — request escalation to the DPO team.
• Response Time: phmanalo commits to acknowledging DPO requests within five (5) business days and providing a substantive response within thirty (30) days.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have been violated. phmanalo encourages you to contact us first so we can attempt to resolve your concern promptly.