php38 Privacy Policy

1. Introduction

php38 ("php38," "we," "us," or "the Platform"), the operator of php38.club, is committed to protecting the personal data of all players and users of the platform in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its implementing rules and regulations as overseen by the National Privacy Commission (NPC) of the Philippines.

This Privacy Policy ("Policy") describes how php38 collects, uses, discloses, stores, and protects personal data provided by or generated through users' interaction with the php38 platform, including the website at php38.club and any associated mobile-optimized interfaces. This Policy forms part of the php38 Terms & Conditions and should be read in conjunction with that document.

By registering for a php38 account or using any part of the platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent, you should not register for or use the php38 platform.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, the data controller responsible for the personal data of php38 users is the operator of php38.club. The data controller determines the purposes and means of processing players' personal information and is accountable for compliance with applicable data protection obligations.

php38 has designated a Data Protection Officer (DPO) as required under the DPA. The DPO is responsible for overseeing data protection practices, handling data subject requests, and serving as the primary point of contact for the National Privacy Commission. Contact details for the php38 DPO are provided in Section 15 of this Policy.

3. Personal Data We Collect

php38 collects the following categories of personal data from players and users:

php38 does not intentionally collect sensitive personal information as defined under the DPA (e.g., racial or ethnic origin, political opinions, religious beliefs, health data) unless specifically required for regulatory compliance such as responsible gaming assessments.

4. How We Collect Your Data

php38 collects personal data through the following means:

• Direct collection: Information you provide voluntarily when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile;
• Automated collection: Technical and usage data collected automatically via cookies, server logs, and similar technologies when you access the php38 platform;
• Third-party sources: Identity verification and fraud prevention providers (e.g., KYC service providers) may supply additional data used to confirm your identity or assess fraud risk; payment processors may provide transaction confirmation data.

5. Purposes of Processing

php38 processes personal data only for the following specified, legitimate purposes:

• To create and manage your php38 player account;
• To process deposits and withdrawals via GCash, PayMaya, and Philippine bank channels;
• To verify your identity and age (21+) in compliance with PAGCOR requirements and the DPA;
• To prevent and detect fraud, money laundering, and other prohibited activities in line with Anti-Money Laundering Act (AMLA) obligations;
• To administer the php38 Circle loyalty program and VIP tier benefits;
• To provide customer support and respond to inquiries;
• To send service-related communications (e.g., transaction confirmations, security alerts, policy updates);
• To send promotional communications where you have provided explicit consent;
• To improve platform performance, user experience, and game personalization;
• To fulfill obligations under applicable Philippine law, including reporting obligations to PAGCOR and the Anti-Money Laundering Council (AMLC).

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, php38 processes personal data on the following legal bases:

• Contract performance: Processing necessary to enter into and perform the player account agreement, including payment processing and game delivery;
• Legal obligation: Processing required to comply with applicable Philippine laws including PAGCOR regulations, AMLA obligations, and NPC reporting requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gaming monitoring, balanced against players' privacy rights;
• Consent: Processing for marketing communications and optional personalization features, where you have provided explicit, freely-given consent that may be withdrawn at any time.

7. Data Sharing and Disclosure

php38 does not sell personal data. We share personal data only with the following categories of recipients and only to the extent necessary for the stated purpose:

• Payment processors: GCash (Mynt), PayMaya (Maya Bank), BPI, BDO, and Metrobank receive the minimum financial data necessary to process your transactions;
• KYC and fraud prevention providers: Third-party identity verification services used to confirm player eligibility and detect fraudulent activity;
• Game content providers: Gaming software providers may receive anonymized gameplay data for technical support purposes only; they do not receive identity or financial data;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies where required by law;
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged under confidentiality obligations.

All third-party recipients are required by contract to process personal data only for the specified purpose, to maintain adequate security measures, and to comply with applicable Philippine data protection obligations.

8. International Data Transfers

Some of php38's third-party service providers (such as cloud infrastructure providers or game content suppliers) may be located outside the Philippines. Where personal data is transferred to recipients in foreign jurisdictions, php38 ensures that adequate safeguards are in place in accordance with Section 21 of the Data Privacy Act, including data processing agreements containing standard contractual clauses approved by the NPC where applicable.

php38 will not transfer personal data to a foreign country that does not provide a level of protection substantially equivalent to the standards set by the DPA unless appropriate safeguards and player consent have been obtained.

9. Data Retention

php38 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any longer retention periods required by law. The following retention guidelines apply:

• Account and identity data: Retained for the duration of the active account relationship plus five years following account closure, in accordance with AMLA record-keeping requirements;
• Financial transaction records: Retained for a minimum of five years from the date of the transaction, as required by the Anti-Money Laundering Act;
• Gaming activity data: Retained for three years from the date of the relevant session or transaction;
• Support communications: Retained for two years from the date of the interaction unless subject to an ongoing dispute;
• Technical and log data: Retained for up to 12 months, except where required for security investigations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification.

10. Security Measures

php38 implements a combination of technical, organizational, and physical security measures to protect player personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and php38 servers;
• Encryption of sensitive data fields (including passwords and financial identifiers) at rest using industry-standard algorithms;
• Two-factor authentication (2FA) available to all players and required for all php38 administrative accounts;
• Access controls restricting internal access to personal data on a need-to-know basis, with comprehensive access logging;
• Regular penetration testing and security audits conducted by independent third parties;
• Incident response and breach notification procedures compliant with NPC requirements under the DPA.

11. Cookies and Tracking Technologies

php38 uses cookies and similar tracking technologies to operate the platform, authenticate sessions, remember user preferences, analyze usage patterns, and deliver relevant promotions. The following categories of cookies are used:

• Strictly necessary cookies: Required for platform functionality including session management and security. These cannot be disabled without breaking core features;
• Performance and analytics cookies: Collect anonymized data about how players use the platform to help us improve performance and user experience;
• Functional cookies: Remember your preferences (e.g., preferred language, game settings) to personalize your php38 experience;
• Marketing cookies: Used only where you have provided explicit consent to receive personalized promotions relevant to your gaming preferences.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of parts of the php38 platform. php38 does not use third-party advertising networks that track users across external websites.

12. Your Data Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by php38:

• Right to be informed: The right to know what personal data is being collected, how it is used, and with whom it is shared — as documented in this Policy;
• Right of access: The right to request a copy of the personal data php38 holds about you;
• Right to rectification: The right to correct inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of personal data that is no longer necessary for the purposes for which it was collected, subject to retention obligations imposed by Philippine law;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation;
• Right to data portability: The right to receive personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data rights have been violated.

To exercise any of the above rights, submit a written request to the php38 Data Protection Officer using the contact details in Section 15. php38 will respond to verified requests within 30 calendar days. We may require identity verification before processing any data subject request.

13. Minors

php38 does not knowingly collect personal data from individuals under 21 years of age. The platform is strictly restricted to adults aged 21 and above in compliance with PAGCOR regulations. If php38 discovers that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account closed.

If you are a parent or guardian and believe that a person under 21 has provided personal data to php38, please contact us immediately using the contact information in Section 15 so that appropriate action may be taken.

14. Updates to This Privacy Policy

php38 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, or platform features. Material changes will be communicated to registered players via email to their registered address and/or through a prominent notice upon next login to the platform.

The date of the most recent revision is displayed at the top of this Policy. Your continued use of the php38 platform following notification of a material update constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

15. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by php38, please contact the Data Protection Officer. The php38 DPO is the designated contact point for all data privacy matters including data subject access requests, erasure requests, and complaints.

You may reach the php38 Data Protection Officer via the customer support live chat available 24/7 on the platform, or by email at the address below. This email address is provided as plain text only and is not a clickable link.

[email protected]

(Plain text only — not a clickable link. Copy and paste into your email client. Please include "DPO Request" in the subject line.)

If you are not satisfied with php38's response to your data privacy concern, you have the right to file a complaint directly with the National Privacy Commission of the Philippines (privacy.gov.ph).