phatay Privacy Policy

1.1 For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, phatay is the personal information controller responsible for the personal data processed in connection with the phatay platform accessible at https://phatay.vip.

1.2 phatay operates an online casino and sports betting platform serving Filipino players across the Philippines. The platform provides live casino games, slots, bingo, sabong, sports betting, and associated financial services including GCash, Maya, and bank deposit and withdrawal processing.

1.3 Questions, requests, and concerns relating to this Privacy Policy may be directed to the phatay Data Privacy team via the contact details provided in Section 14 of this Policy.

2.1 This Privacy Policy applies to all personal data collected by phatay in connection with:

• Registration and maintenance of phatay player accounts;
• Deposits, withdrawals, and other financial transactions processed through the phatay platform;
• Use of any game, feature, or service on the phatay platform;
• Communications between players and phatay's support team via live chat, email, or any other channel;
• Participation in phatay promotions, bonus programs, and the VIP loyalty program;
• Browsing the phatay website, including data collected via cookies and similar technologies.

2.2 This Policy does not apply to third-party websites or services that may be referenced in phatay's content. phatay is not responsible for the privacy practices of any third-party services.

3.1 phatay collects the following categories of personal data:

3.2 phatay does not intentionally collect sensitive personal information as defined under RA 10173 (such as health data, religious beliefs, or political opinions) except where expressly required for responsible gaming assessments conducted at the Player's request.

3.3 Voluntarily Provided Data. Some data you provide to phatay directly — for example, the information you enter during account registration, identity verification documents uploaded during KYC, or messages sent to our support team. Providing this information is necessary to access phatay's services.

3.4 Automatically Collected Data. Some data is collected automatically when you visit or use the phatay platform, including technical device data, IP addresses, and usage information. This data is used to operate and improve the Platform and to detect fraud and unauthorized access.

4.1 phatay processes personal data under the following legal bases as recognized under RA 10173:

• Contractual Necessity: Processing required to fulfil our obligations under the phatay Terms and Conditions, including account operation, game delivery, and payment processing.
• Compliance with Legal Obligation: Processing required to comply with Philippine law, including the Anti-Money Laundering Act (AMLA), PAGCOR regulations, National Privacy Commission requirements, and tax obligations.
• Legitimate Interests: Processing conducted for phatay's legitimate business interests, including fraud detection, platform security, and improvement of services, where such interests are not overridden by the Player's rights.
• Consent: Processing for marketing communications and non-essential cookies, where your explicit consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of processing conducted before the withdrawal.

5.1 phatay uses your personal data for the following purposes:

• Account Management: To create, verify, operate, and maintain your phatay account, including processing your login credentials and account settings.
• Identity Verification (KYC): To verify your identity and age in compliance with PAGCOR requirements and Philippine AMLA regulations before processing withdrawals and at other required trigger points.
• Payment Processing: To process deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, and other supported Philippine payment channels.
• Game Delivery: To deliver gaming services, maintain game state and history, and calculate and credit winnings to your account.
• Customer Support: To respond to support queries, resolve account issues, and maintain records of communications for quality assurance and dispute resolution purposes.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and unauthorized platform access.
• Responsible Gaming: To implement player-requested restrictions (deposit limits, self-exclusion, session limits) and to identify patterns of play that may indicate problem gambling, in compliance with PAGCOR's responsible gaming guidelines.
• Legal Compliance: To fulfil phatay's reporting and record-keeping obligations under Philippine law, including mandatory reporting to PAGCOR and the Anti-Money Laundering Council (AMLC) where required.
• Marketing Communications: Where you have provided consent, to send promotional offers, bonus notifications, and platform updates via your registered mobile number or email address. You may opt out at any time via account settings or by contacting support.
• Platform Improvement: To analyse usage patterns, improve game offerings, optimise platform performance, and develop new features relevant to Filipino players.

6.1 phatay uses cookies and similar technologies (such as local storage and session tokens) on the Platform. These technologies serve the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function, including maintaining your logged-in session, remembering your language preference, and enabling core security features. These cannot be disabled without affecting Platform functionality.
• Analytics Cookies: Used to understand how players use the Platform — which pages are visited most, where players navigate to after login, and how long sessions last. This data is used in aggregated, anonymised form to improve the Platform.
• Preference Cookies: Used to remember your settings and preferences, such as your last-played game category, so you don't have to reconfigure your experience each session.

6.2 You may control non-essential cookies through the phatay cookie preference centre, accessible from the Platform's footer. Disabling certain cookies may affect the functionality of some Platform features.

6.3 phatay does not use cookies to serve third-party advertising on its Platform.

7.1 phatay may share your personal data with the following categories of third parties:

• Payment Service Providers: GCash (GXI), Maya (Voyager Innovations), GrabPay, InstaPay network participants, and Philippine bank partners, for the purpose of processing deposits and withdrawals.
• Identity Verification Providers: Third-party KYC service providers that assist with identity document verification and anti-fraud screening.
• Game Providers: Licensed game content providers including Pragmatic Play, PG Soft, JILI, and others, who may receive anonymised session data necessary for game delivery and RNG certification.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies, where disclosure is required by applicable law.
• IT and Security Service Providers: Cloud infrastructure, cybersecurity, and fraud detection service providers who process data on behalf of phatay under strict data processing agreements.

7.2 All third parties that process personal data on phatay's behalf are contractually bound to process that data only for the specified purpose and in accordance with applicable Philippine data privacy law.

8.1 phatay retains personal data for the periods described below, after which data is securely deleted or anonymised:

• Account Data: Retained for the duration of the active account, and for a period of five (5) years following account closure.
• KYC / Identity Verification Records: Retained for a minimum of five (5) years from the date of verification, as required under Philippine AMLA regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with the Anti-Money Laundering Act.
• Gaming History: Retained for a period of three (3) years following the relevant session, for purposes of dispute resolution and responsible gaming monitoring.
• Support Communications: Retained for a period of two (2) years from the date of each interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of the consented-to marketing activity, plus one (1) year, as evidence of consent.

8.2 Where legal proceedings are commenced relating to a Player's account, relevant records may be retained beyond the standard retention periods until all proceedings are fully resolved.

9.1 phatay implements technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encryption: 256-bit SSL/TLS encryption for all data in transit between your device and phatay servers; AES-256 encryption for sensitive data stored at rest.
• Access Controls: Role-based access controls ensuring that phatay employees can only access personal data necessary for their specific job function.
• Two-Factor Authentication: Required for administrative access to systems containing personal data; available to Players for account login.
• Intrusion Detection: Continuous monitoring of platform systems for unauthorised access attempts and anomalous activity.
• Regular Security Assessments: Periodic vulnerability assessments and penetration testing of phatay's platform infrastructure.
• Staff Training: Data privacy and security awareness training for all phatay employees with access to personal data.

9.2 In the event of a personal data breach that is likely to result in harm to affected individuals, phatay will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected Players as required under RA 10173.

10.1 Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, you have the following rights with respect to your personal data held by phatay:

• Right to Be Informed: The right to know how your personal data is being collected and processed — which is the primary purpose of this Privacy Policy.
• Right of Access: The right to obtain a copy of your personal data held by phatay, along with information about how it is being processed.
• Right to Correction: The right to have inaccurate or incomplete personal data corrected or updated without unreasonable delay.
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to phatay's legal retention obligations.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format for transfer to another controller, where technically feasible.
• Right to Object: The right to object to processing of your personal data based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe phatay has violated your data privacy rights.

10.2 To exercise any of the above rights, contact phatay's Data Privacy Officer via the details in Section 14. phatay will respond to all valid requests within thirty (30) calendar days. Complex requests may require an extension of up to sixty (60) days, in which case you will be notified.

10.3 phatay may decline to fulfil requests where doing so would conflict with legal obligations (for example, the mandatory retention of KYC records under AMLA) or would adversely affect the rights of other individuals.

11.1 The phatay platform is a real-money gaming service restricted to adults aged 21 and above, in compliance with PAGCOR's age requirements for online gaming participation in the Philippines. phatay does not knowingly collect, process, or retain personal data from persons under 21 years of age.

11.2 If phatay becomes aware that personal data has been collected from an individual under 21 years of age, that account will be immediately suspended, all associated data will be deleted, and any deposited funds will be returned to the source payment method after identity verification of the account holder.

11.3 If you believe that a minor may have created a phatay account using false age information, please contact phatay support immediately via live chat or the support email address.

12.1 Some of phatay's third-party service providers — including game content providers and cloud infrastructure partners — may be located outside the Philippines. Where personal data is transferred to a recipient in another country, phatay ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating privacy protections equivalent to those required under RA 10173;
• Transfer only to jurisdictions or organisations that have been assessed as providing an adequate level of protection for personal data.

12.2 By creating and using a phatay account, you acknowledge that your personal data may be processed in countries outside the Philippines in connection with the third-party services described in Section 7 of this Policy.

13.1 phatay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or changes to the phatay platform and its services.

13.2 Material changes to this Policy will be communicated to registered Players via their registered email address or via a prominent notice on the phatay Platform at least 14 days before the changes take effect.

13.3 The most current version of this Privacy Policy is always available at https://phatay.vip/privacy-policy. The "Last Updated" date at the top of this Policy reflects when the current version entered into force.

13.4 Your continued use of the phatay Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of, and agreement to, the updated terms.

14.1 For questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data by phatay, please contact us through the following channels:

14.2 For formal privacy requests (data access, correction, deletion, portability, or objection requests), please contact us via email with the subject line "Data Privacy Request – [Your Request Type]" from the email address registered to your phatay account. This allows us to verify your identity before processing the request.

14.3 If you are not satisfied with phatay's response to a privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about the NPC's complaint process is available through the NPC's official channels.