phcom Privacy Policy

1. Introduction

1.1 phcom (referred to in this document as "phcom," "we," "us," or "our") is committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, applicants, and website visitors.

1.2 This Privacy Policy describes the categories of personal data we collect, the purposes for which we process it, the parties with whom we share it, and the rights available to you under applicable Philippine law.

1.3 This Policy applies to all personal data collected through the phcom website (phcom.vip), mobile-optimised web platform, customer support channels, and any other service operated under the phcom brand.

1.4 Please read this Policy in conjunction with our Terms & Conditions and Responsible Gaming policy, which together govern your use of the phcom platform.

2. Data Controller

2.1 phcom is the Data Controller for personal data collected through the phcom platform, as defined under the Data Privacy Act of 2012. As Data Controller, phcom determines the purposes and means of processing your personal data.

2.2 phcom has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data protection law. Contact details for the DPO are provided in Section 15 of this Policy.

2.3 The phcom platform operates under a licence within the Philippine Amusement and Gaming Corporation ("PAGCOR") regulatory framework, which imposes specific data collection, retention, and reporting obligations on licensed operators.

3. Personal Data We Collect

phcom collects personal data in the following categories:

3.1 Registration Data. When you create a phcom account, we collect your full legal name, date of birth, mobile number, email address, residential address, and nationality. This data is required to fulfil our contractual obligations and regulatory KYC requirements.

3.2 Identity Verification Documents. To comply with PAGCOR KYC requirements and the Anti-Money Laundering Act, we collect copies of government-issued Philippine identification documents, which may include your PhilSys National ID, UMID, passport, driver's licence, or Voter's ID.

3.3 Payment Data. We collect information necessary to process deposits and withdrawals, including GCash account references, Maya account references, and Philippine bank account details. We do not store full payment credentials — these are tokenised and processed through licensed payment service providers.

3.4 Gaming Activity Data. We maintain records of all bets placed, games accessed, session durations, winnings and losses, and bonus usage. This data is required for PAGCOR regulatory reporting and responsible gaming monitoring.

3.5 Technical Data. We automatically collect device identifiers, IP addresses, browser type and version, operating system, referring URLs, and session timestamps when you access the phcom platform. This data is used for security monitoring, fraud prevention, and platform optimisation.

3.6 Communications Data. Records of your interactions with phcom customer support, including live chat transcripts, email correspondence, and support ticket content, are retained for quality assurance and dispute resolution purposes.

3.7 Responsible Gaming Data. If you set responsible gaming limits, request self-exclusion, or interact with our responsible gaming tools, we record this information to enforce your preferences and comply with our regulatory obligations.

4. How phcom Uses Your Personal Data

phcom processes your personal data for the following purposes:

• Creating and managing your phcom account;
• Verifying your identity and age in compliance with PAGCOR requirements and the Data Privacy Act;
• Processing deposits, withdrawals, and financial transactions;
• Providing access to games, bonuses, and promotional offers;
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited conduct;
• Complying with legal obligations, including PAGCOR regulatory reporting, Anti-Money Laundering Act ("AMLA") requirements, and tax obligations;
• Operating and enforcing responsible gaming tools, including deposit limits and self-exclusion;
• Providing customer support and resolving disputes;
• Sending transactional communications (account confirmations, deposit receipts, security alerts);
• Sending marketing communications, where you have provided consent or where permitted by law — you may opt out at any time;
• Improving the platform through aggregated, anonymised analytics.

phcom does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without human oversight.

5. Legal Basis for Processing

phcom processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you as a registered player;
• Legal Obligation: Processing required to comply with PAGCOR regulations, AMLA obligations, and other applicable Philippine laws;
• Legitimate Interests: Processing necessary for fraud prevention, platform security, and responsible gaming monitoring;
• Consent: Processing for marketing communications and non-essential analytics, where you have provided explicit consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Sharing Your Personal Data

phcom does not sell, rent, or trade your personal data. We share personal data only in the following circumstances:

• Licensed Game Providers: Game providers (such as JILI, Pragmatic Play, PG Soft, and Evolution Gaming) receive anonymised or pseudonymised player identifiers necessary to provide game services. They do not receive your full personal profile.
• Payment Processors: GCash, Maya, and banking partners receive only the transaction data required to process deposits and withdrawals. These parties are bound by their own regulatory obligations and data processing agreements with phcom.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council ("AMLC"), the National Privacy Commission ("NPC"), and other competent Philippine authorities may receive player data pursuant to lawful orders, regulatory requirements, or mandatory reporting obligations.
• Service Providers: IT infrastructure providers, customer support platform vendors, and analytics providers may process personal data as data processors acting on phcom's instructions under written data processing agreements that prohibit independent use.
• Law Enforcement: Where required by a valid court order or law enforcement request under Philippine law.

7. International Data Transfers

7.1 Some of phcom's service providers and game technology partners are located outside the Philippines. Where personal data is transferred internationally, phcom ensures that appropriate safeguards are in place, including data processing agreements incorporating the National Privacy Commission's standard contractual clauses or equivalent protections.

7.2 phcom does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate contractual, technical, and organisational safeguards.

8. Data Retention

8.1 phcom retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account registration and identity documents: a minimum of five (5) years following account closure, as required by PAGCOR regulations;
• Transaction records: a minimum of five (5) years, as required by the Anti-Money Laundering Act;
• Customer support communications: two (2) years from the date of the interaction;
• Marketing consent records: three (3) years from the date of consent withdrawal.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction. Hard copy documents containing personal data are securely destroyed.

9. Cookies and Tracking Technologies

9.1 Essential Cookies. These cookies are strictly necessary for the phcom platform to function. They manage session authentication, security tokens, and user interface preferences. They cannot be disabled without impairing platform functionality.

9.2 Functional Cookies. These cookies remember your preferences (such as language settings and responsible gaming limit displays) to improve your experience. They are activated based on your interactions with the platform.

9.3 Analytical Cookies. With your consent, phcom uses anonymised analytics to understand how players use the platform, identify technical issues, and improve service quality. These cookies do not identify individual users.

9.4 Managing Cookies. You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from using the platform. Disabling functional or analytical cookies will not affect your ability to play but may reduce personalisation features.

10. Data Security

10.1 phcom implements technical and organisational security measures proportionate to the risk of the personal data we process. These measures include:

• 256-bit TLS encryption for all data in transit;
• AES-256 encryption for sensitive data at rest;
• Payment credential tokenisation — raw GCash, Maya, or bank account numbers are not stored on phcom servers;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Multi-factor authentication for all internal systems containing personal data;
• Regular penetration testing and vulnerability assessments by independent security firms;
• 24/7 automated fraud and anomaly detection monitoring.

10.2 In the event of a personal data breach that is likely to result in risk to your rights and freedoms, phcom will notify the National Privacy Commission within 72 hours of becoming aware, and affected individuals without undue delay, in accordance with the Data Privacy Act.

11. Your Data Protection Rights

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data held by phcom:

• Right to Be Informed: The right to be told what personal data we collect and how we use it — this Policy fulfils that obligation;
• Right of Access: The right to request a copy of the personal data phcom holds about you;
• Right to Correction: The right to have inaccurate or incomplete personal data corrected or completed;
• Right to Erasure: The right to request deletion of your personal data, subject to our legal retention obligations;
• Right to Data Portability: The right to receive your personal data in a structured, machine-readable format;
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing;
• Right to Damages: The right to claim compensation for damages suffered due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of personal data.

To exercise any of these rights, submit a written request to our Data Protection Officer at the contact details in Section 15. We will respond within fifteen (15) business days. Identity verification may be required before we can fulfil your request.

12. Children and Minors

12.1 The phcom platform is strictly prohibited to individuals under 21 years of age. We do not knowingly collect personal data from anyone under 21. Age verification is conducted through our KYC process prior to enabling withdrawal access.

12.2 If we discover that personal data has been collected from a person under 21, that data will be deleted immediately, the associated account will be permanently closed, and the matter will be referred to PAGCOR as required by applicable regulations.

12.3 If you believe that a minor has registered an account on phcom, please contact our Data Protection Officer or customer support team immediately.

13. Anti-Money Laundering Obligations

13.1 As a PAGCOR-regulated operator, phcom is subject to the Anti-Money Laundering Act of 2001 (Republic Act No. 9160, as amended) and PAGCOR's AML/CTF compliance framework. This requires us to collect, verify, and retain certain personal and financial data, and to report covered and suspicious transactions to the Anti-Money Laundering Council ("AMLC").

13.2 AML-related data processing is conducted on the basis of legal obligation and cannot be refused or restricted by the data subject. Transaction reports submitted to AMLC are made in strict confidence and do not constitute a breach of privacy obligations.

14. Amendments to This Privacy Policy

14.1 phcom may update this Privacy Policy from time to time to reflect changes in our processing activities, legal obligations, or platform operations. Material changes will be communicated via registered email or prominent in-platform notice at least fourteen (14) days before taking effect.

14.2 The current version of this Privacy Policy is always accessible at phcom.vip/privacy-policy. The "Last Updated" date at the top of this document indicates when the most recent revision was made.

14.3 Your continued use of the phcom platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

15. Contact & Data Protection Officer

For all privacy-related enquiries, data subject access requests, or complaints regarding phcom's handling of your personal data, please contact our Data Protection Officer: