ph2com Privacy
Policy

1. Introduction and Identity of the Data Controller

ph2com ("ph2com," "we," "us," or "our") operates the online gaming platform available at ph2com.app and is the data controller responsible for the personal data of its users. ph2com is committed to protecting the privacy and personal information of all players and is fully compliant with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and applicable directives issued by the National Privacy Commission (NPC) of the Philippines.

As an online gaming operator aligned with PAGCOR regulations, ph2com is also subject to data retention and reporting obligations imposed by PAGCOR and Philippine anti-money laundering authorities. Where such obligations require data processing, ph2com fulfils them as a legal duty, not by discretion.

2. Personal Data We Collect

ph2com collects personal data in the following categories, depending on your interaction with the Platform:

ph2com does not collect data classified as sensitive personal information under the DPA (such as health data, political affiliation, or religious beliefs) unless specifically required by regulatory compliance (e.g., responsible gaming assessments).

3. How ph2com Uses Your Personal Data

ph2com processes your personal data for the following purposes:

• Account creation and management: Registering your player account, verifying your identity, and maintaining your account profile.
• Service delivery: Providing access to casino games, processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank, and delivering the services you have contracted for.
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent activity, multi-accounting, bonus abuse, and unauthorized account access.
• Regulatory compliance: Meeting our obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012, including maintaining transaction records and filing statutory reports.
• Customer support: Responding to your queries, resolving disputes, and processing account-related requests.
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling indicators and facilitating self-exclusion, deposit limits, and other protective tools.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates — only where you have provided consent or where permitted under applicable law. You may opt out at any time.
• Platform improvement: Analysing aggregated, anonymised usage data to improve Platform performance, game selection, and user experience.

4. Legal Basis for Data Processing

Under the Data Privacy Act of 2012, ph2com relies on the following lawful bases for processing personal data:

• Contractual necessity: Processing required to fulfil our agreement with you — account operation, payment processing, game access, and withdrawal handling.
• Legal obligation: Processing required by PAGCOR, the AMLC (Anti-Money Laundering Council), the NPC, or other competent Philippine authorities.
• Legitimate interests: Processing for fraud prevention, security monitoring, and platform integrity — where those interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications and non-essential cookies, where your explicit consent has been obtained. Consent may be withdrawn at any time without affecting prior processing.

5. Data Sharing and Disclosure

ph2com does not sell, rent, or commercially exploit your personal data to third parties. We may disclose your data only in the following circumstances:

• Payment service providers: GCash, PayMaya, and bank partners receive the minimum data necessary to process your transactions.
• Game software providers: Providers supplying live dealer, slot, and sports betting content may receive technical session data necessary to run game sessions. These providers are contractually bound to process data only for service delivery purposes.
• Regulatory authorities: PAGCOR, the AMLC, the NPC, and law enforcement agencies may receive data in response to lawful orders, regulatory requirements, or criminal investigations. ph2com will comply with lawful disclosure requirements.
• Professional advisors: Legal counsel, auditors, and compliance consultants operating under appropriate confidentiality obligations.
• Corporate transactions: In the event of a merger, acquisition, or asset sale, player data may be transferred as part of the transaction. You will be notified of material changes to the data controller's identity as required by law.

All third-party service providers engaged by ph2com are required to implement appropriate technical and organisational security measures and are prohibited from using your data for any purpose beyond the specified service.

6. Cookies and Tracking Technologies

ph2com uses cookies and similar tracking technologies to operate the Platform, maintain your login session, detect fraud, and analyse aggregate usage patterns. Cookies used by ph2com fall into the following categories:

• Strictly necessary cookies: Required for core Platform functionality — login sessions, security tokens, and preference settings. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Collect anonymised data on how users interact with the Platform to inform performance improvements. No personally identifiable information is transmitted to analytics providers.
• Marketing cookies: Used to present relevant promotional content within the Platform. These are only activated where you have provided consent.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use the core Platform services.

7. Data Retention

ph2com retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years as required by the Anti-Money Laundering Act and PAGCOR regulations.
• Communications and support data: Retained for three (3) years from the date of the last communication.
• Marketing preferences: Retained until consent is withdrawn or the account is closed.

Upon expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be associated with an individual player.

8. Security Measures

ph2com implements a range of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and ph2com servers.
• Password hashing using industry-standard cryptographic algorithms. ph2com staff cannot access your plain-text password.
• Two-factor authentication (2FA) available to all account holders for enhanced login security.
• Access controls limiting internal access to personal data to staff with a demonstrable operational need.
• Regular security assessments and penetration testing of Platform infrastructure.
• Incident response procedures — in the event of a personal data breach, ph2com will notify affected players and the National Privacy Commission within the timeframes required by the Data Privacy Act.

9. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, registered ph2com players have the following rights in relation to their personal data:

• Right to be informed: The right to know what data ph2com holds about you and how it is used — fulfilled by this Privacy Policy.
• Right of access: The right to request a copy of the personal data ph2com holds about you.
• Right to rectification: The right to have inaccurate personal data corrected. Update basic contact details via account settings; other corrections require a support request.
• Right to erasure / right to be forgotten: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected — subject to legal retention obligations.
• Right to data portability: The right to receive your personal data in a structured, machine-readable format.
• Right to object: The right to object to processing based on legitimate interests, including profiling for marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the ph2com Data Protection Officer via the 24/7 live chat on the Platform or at [email protected]. ph2com will respond to data subject requests within fifteen (15) working days in line with NPC requirements. If you believe your rights have not been adequately addressed, you may file a complaint with the National Privacy Commission at privacy.gov.ph.

10. Children and Minors

ph2com strictly prohibits the use of its Platform by any person under the age of 21 years, consistent with PAGCOR regulations governing online gaming in the Philippines. ph2com does not knowingly collect personal data from minors. If ph2com discovers that a minor has created an account or provided personal data, the account will be immediately closed, any deposits returned, and all related personal data deleted. If you have reason to believe a minor has registered on ph2com, please contact support immediately.

11. Third-Party Links

The ph2com Platform may contain references or links to third-party websites or services. This Privacy Policy applies solely to data processed by ph2com in connection with the Platform. ph2com is not responsible for the privacy practices of third-party websites. You should review the privacy policies of any third-party service before providing personal data to them.

12. Changes to This Privacy Policy

ph2com may update this Privacy Policy from time to time to reflect changes in legal requirements, regulatory guidance, or Platform operations. Material changes will be communicated to registered players via email notification or prominent in-Platform notice at least seven (7) days prior to the effective date. The current version of the Privacy Policy is always available at ph2com.app/privacy-policy. Continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

13. Contact and Data Protection Officer

For any privacy-related queries, data subject rights requests, or concerns regarding this Policy, please contact the ph2com Data Protection Officer:

• Email: [email protected]
• Live Chat: Available 24/7 via the ph2com Platform
• Response time: All written privacy requests acknowledged within two (2) business days; substantive response within fifteen (15) working days.

If you are dissatisfied with ph2com's handling of your personal data or privacy request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the competent supervisory authority for data protection matters in the Philippines.