php38 Privacy
Policy

php38 ("we", "our", "us", or "the Platform") is committed to protecting the privacy and personal data of all persons who interact with the php38 online casino and sports betting platform, accessible at php38.vip. This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all personal data collected through: (a) the php38 website and mobile web platform; (b) the account registration, KYC verification, and login processes; (c) all financial transactions conducted through the php38 cashier; (d) php38's customer support channels, including live chat and email; and (e) any marketing communications sent by php38 to registered users with their consent.

By creating an account on php38 or continuing to use the platform after this Policy's effective date, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not register an account or continue to use the php38 platform.

The Personal Information Controller responsible for the personal data collected through the php38 platform is:

• Entity: php38 Operations (php38.vip)
• Platform: php38.vip
• Regulatory Authority: Philippine Amusement and Gaming Corporation (PAGCOR)
• Data Protection Officer (DPO) Contact: [email protected]
• NPC Registration: Registered with the National Privacy Commission as required by the DPA for personal information controllers processing personal data exceeding the applicable threshold.

php38's appointed Data Protection Officer (DPO) is responsible for overseeing data protection strategy and implementation, ensuring compliance with the DPA and NPC issuances, handling data subject requests, managing data breach notification procedures, and serving as the primary point of contact with the NPC.

php38 collects only the personal data that is necessary for the specific purposes described in this Policy. The categories of personal data collected are as follows:

php38 does not collect or store full payment card numbers, CVV codes, GCash PINs, or Maya MPINs. These are handled entirely by the respective payment service providers' own encrypted systems.

php38 collects personal data through the following channels and mechanisms:

• Direct Collection: Information you provide directly when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotional activities.
• Automated Collection: Technical and usage data collected automatically when you access the php38 platform, including IP addresses, device identifiers, session data, and gaming activity logs. This data is collected through server logs, cookies, and similar tracking technologies.
• Third-Party Payment Providers: Transaction confirmation data received from GCash, Maya, BPI, BDO, Metrobank, and other payment partners following your authorisation of a payment. php38 receives only the data necessary to confirm and reconcile the transaction.
• Identity Verification Services: During KYC processing, php38 may use a third-party identity verification provider to cross-reference your submitted identity documents against Philippine government databases. This provider acts as a Personal Information Processor (PIP) under php38's instruction.
• PAGCOR and Regulatory Sources: php38 may receive information from PAGCOR or Philippine law enforcement authorities regarding exclusion orders, AML flags, or other compliance matters that affect your account status.

php38 processes your personal data only for specific, explicit, and legitimate purposes. The following table summarises the primary processing purposes and the corresponding legal basis under the DPA:

• Account creation and management — Necessary for the performance of the contract between you and php38 (Section 12(b), DPA).
• KYC identity verification and age verification (21+) — Required by PAGCOR licensing obligations and Philippine AMLA (Section 12(c), DPA — compliance with legal obligation).
• Processing deposits, withdrawals, and financial transactions — Necessary for contract performance and legal obligation under AMLA (Sections 12(b) and 12(c), DPA).
• Fraud detection, security monitoring, and prevention of prohibited activities — Legitimate interests of php38 and compliance with PAGCOR requirements (Section 12(f), DPA).
• Responsible gaming monitoring and intervention — Legal obligation under PAGCOR responsible gaming standards and legitimate interests (Section 12(c) and 12(f), DPA).
• Customer support and dispute resolution — Necessary for the performance of the contract (Section 12(b), DPA).
• Regulatory reporting to PAGCOR and compliance with AMLA — Legal obligation (Section 12(c), DPA).
• Sending marketing communications about php38 promotions and new features — Consent-based (Section 12(a), DPA). You may withdraw consent at any time through account notification settings.
• Platform improvement and analytics — Legitimate interests of php38, using anonymised or aggregated data wherever possible (Section 12(f), DPA).

php38 shares personal data only where strictly necessary and in accordance with the DPA. The categories of recipients are as follows:

• PAGCOR: As the regulatory authority overseeing php38's operations, PAGCOR may require access to player account data, gaming records, and financial transaction data for compliance audits, licensing renewals, and investigation of complaints.
• Philippine Anti-Money Laundering Council (AMLC): php38 is required by the Anti-Money Laundering Act (RA 9160, as amended) to report covered transactions and suspicious transactions to the AMLC. This may involve disclosure of identity data and transaction records without prior notice to the Player where required by law.
• Payment Service Providers: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and other payment partners receive the transaction data necessary to process your deposits and withdrawals. These providers have their own privacy policies governing their use of this data.
• Identity Verification Providers: Third-party KYC processing services receive identity documents and personal data for verification purposes only, under contractual obligations of confidentiality and as Personal Information Processors under php38's instruction.
• IT Infrastructure and Cloud Service Providers: php38's technology infrastructure partners who provide hosting, data storage, and platform services may process personal data on php38's behalf as Personal Information Processors. All such providers are bound by data processing agreements compliant with the DPA.
• Philippine Law Enforcement: Where required by court order, warrant, or lawful directive of Philippine law enforcement authorities, php38 may disclose personal data to the relevant authority.

php38 does not transfer personal data to third parties for their own direct marketing purposes. All third-party service providers who process personal data on php38's behalf are subject to contractual obligations at least as protective as this Policy.

php38 uses cookies and similar technologies on the php38.vip platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that maintain your logged-in state, security tokens, and load-balancing cookies. These cookies cannot be disabled without preventing access to the platform.
• Functional Cookies: Used to remember your preferences, such as language settings, responsible gaming limit configurations, and game lobby layout preferences.
• Analytics Cookies: php38 uses analytics tools to understand how players use the platform — which pages are visited, which games are played, and where technical errors occur. Analytics data is collected in aggregated or anonymised form wherever possible.
• Security Cookies: Used for fraud detection, bot identification, and login anomaly monitoring. These cookies help protect your account and the integrity of the php38 platform.

php38 does not use third-party advertising cookies or permit third-party advertisers to place tracking cookies on the php38 platform.

php38 retains personal data for the period necessary to fulfil the purposes for which it was collected, subject to the following retention schedules:

• Account and Identity Data: Retained for the lifetime of the active account, plus a minimum of five (5) years following account closure. This retention period is mandated by the Anti-Money Laundering Act and PAGCOR licensing requirements.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of the transaction, as required by AMLA. This includes all deposit, withdrawal, and bet records.
• KYC Identity Documents: Retained for a minimum of five (5) years following account closure or the date the document was superseded by an updated document, whichever is later.
• Gaming Activity Data: Retained for five (5) years, consistent with PAGCOR audit and responsible gaming record-keeping requirements.
• Customer Support Correspondence: Retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Marketing Preference Data: Retained until you withdraw your marketing consent, plus one (1) year for audit purposes.
• Technical Log Data: Retained for twelve (12) months from collection, unless a security incident requires extended retention for investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC-approved data disposal procedures.

php38 implements appropriate technical and organisational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. The primary security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and php38's servers is encrypted using industry-standard SSL/TLS protocols. This applies to all pages of the php38 platform, including the login, registration, cashier, and account settings sections.
• Data Encryption at Rest: Personal data stored in php38's databases, including identity documents and financial records, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within php38's systems is restricted on a strict need-to-know basis. Employee access is governed by role-based access controls, and all privileged access is logged and audited.
• Two-Factor Authentication: php38 requires two-factor authentication for all internal staff accessing player data systems. Player-facing 2FA is strongly recommended and available for all accounts.
• Penetration Testing and Security Audits: php38's platform undergoes regular independent security testing to identify and remediate vulnerabilities before they can be exploited.
• Data Breach Response: php38 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to data subjects, php38 will notify the National Privacy Commission within seventy-two (72) hours of discovery, and will notify affected individuals where required under the DPA.

php38's primary data infrastructure is located within the Philippines. However, certain technology service providers used by php38 — including cloud hosting, analytics, and identity verification services — may process personal data outside the Philippines.

Where personal data is transferred outside the Philippines, php38 ensures that such transfers are carried out only under the following conditions:

• The recipient country provides an adequate level of data protection as determined by the NPC; or
• php38 has entered into a data transfer agreement with the recipient that imposes data protection obligations at least equivalent to those required under the Philippine DPA; or
• The transfer is required by PAGCOR, AMLC, or applicable Philippine law, in which case the statutory requirement itself provides the legal basis for the transfer.

php38 does not transfer personal data to jurisdictions that are not compliant with the data protection standards required under Philippine law without implementing the appropriate contractual and technical safeguards.

The php38 platform is strictly intended for persons aged 21 years and above, as required by PAGCOR for all Philippines-based online gambling services. php38 does not knowingly collect personal data from persons under 21 years of age.

php38 enforces this age restriction through mandatory KYC identity verification at the account registration stage. Any account found to be registered by a person under 21 years of age will be immediately closed, all associated funds will be forfeited in accordance with PAGCOR regulations, and any personal data collected will be securely deleted from php38's systems within a reasonable timeframe, subject to any legal retention obligations.

If you believe that php38 has inadvertently collected personal data from a person under the age of 21, please contact the php38 Data Protection Officer immediately at [email protected] so that appropriate corrective action can be taken.

php38 may send you promotional communications about new games, bonuses, seasonal offers, and platform updates. Marketing communications are sent only with your consent, which you provide during account registration or through your account notification settings.

Marketing communications from php38 may be delivered via:

• SMS to your registered Philippine mobile number
• Email to your registered email address
• In-platform notifications within the php38 logged-in interface
• Push notifications via the php38 Progressive Web App (PWA), where enabled on your device

You can withdraw your marketing consent and opt out of all marketing communications at any time through Account Settings → Notifications, or by contacting php38 customer support. Opt-out requests are processed within 24 hours. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of your rights under the Philippine Data Privacy Act as described in the Your Rights section of this Policy, please contact php38's Data Protection Officer using the following procedure:

1. Submit your request in writing to [email protected] with the subject line "DATA SUBJECT REQUEST – [Type of Request]" (e.g., "DATA SUBJECT REQUEST – ACCESS").
2. Include your registered Philippine mobile number and the email address associated with your php38 account for identity verification.
3. Describe the specific data or processing activity to which your request relates.
4. php38 may require additional identity verification before processing your request, to ensure that personal data is not disclosed or modified in response to requests from unauthorized persons.

php38 will acknowledge all data subject requests within five (5) business days of receipt and will provide a substantive response within thirty (30) calendar days. Where a request is complex or involves a large volume of data, php38 may extend this period by a further thirty (30) days, with notification of the extension provided within the initial response period.

Data subject rights requests are provided free of charge for reasonable requests. php38 may charge a reasonable administrative fee for manifestly unfounded or excessive requests, or for additional copies of data beyond the first.

If you are not satisfied with php38's response to a data subject rights request, or if you believe that php38 has processed your personal data in violation of the Data Privacy Act of 2012, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

Before escalating to the NPC, php38 requests that you first attempt to resolve the matter through php38's internal Data Protection Officer contact at [email protected]. This allows php38 the opportunity to address the concern directly and, in many cases, leads to a faster resolution.

The NPC accepts complaints through its official channels. Please refer to the NPC's official website for current complaint filing procedures. php38 fully cooperates with NPC investigations and will provide all requested documentation and records within the timeframes specified by the NPC.

php38 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in Philippine privacy law or NPC guidance, changes in PAGCOR requirements, or updates to our platform features and technology.

The effective date of the current version of this Policy is displayed at the top of this page. The most current version will always be available at php38.vip/privacy-policy.

For material changes to this Policy — particularly changes that affect the purposes for which we process your personal data or the third parties with whom we share it — php38 will provide advance notice via account notification or email to your registered address, where practicable, at least five (5) business days before the change takes effect.

Your continued use of the php38 platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree with a material change, you may close your php38 account before the change takes effect by contacting our support team via live chat.

For all privacy-related enquiries, data subject requests, or concerns about how php38 handles your personal data, please contact the php38 Data Protection Officer through the following channels:

• Email (preferred for written requests): [email protected] — Use subject line "PRIVACY ENQUIRY" or "DATA SUBJECT REQUEST" as appropriate.
• Live Chat: Available 24/7 through the chat widget on php38.vip for general privacy questions and non-complex requests.

When contacting php38 regarding a privacy matter, please provide your registered Philippine mobile number and a clear description of your enquiry or request. Do not include sensitive financial information such as full GCash account numbers or ID document numbers in live chat — these should be provided only through the secure identity verification process when requested by the DPO.

This Privacy Policy was last revised on 1 January 2026. Version 3.1. Issued in compliance with Republic Act No. 10173 (Data Privacy Act of 2012) and NPC implementing regulations.