phopin Privacy Policy

1. Introduction

phopin ("we", "us", "our") is committed to protecting the privacy and personal data of every player who interacts with our Platform. We understand that Filipino players entrust us with sensitive information — including financial details and identity documents — and we take that responsibility seriously.

This Privacy Policy has been drafted in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) as promulgated by the National Privacy Commission (NPC) of the Philippines. Where applicable, we also adhere to internationally recognised data protection principles consistent with the Organisation for Economic Co-operation and Development (OECD) Privacy Framework.

This policy covers:

• What personal information phopin collects from players and visitors;
• The purposes for which we process that information;
• The legal bases that authorise such processing;
• How we store, protect, and retain your data;
• When and with whom we share your data;
• The rights available to you as a data subject under Philippine law; and
• How to contact us or file a complaint regarding your data.

By registering an account or continuing to use the phopin Platform after this policy has been made available to you, you acknowledge that you have read and understood its terms.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and its IRR, phopin acts as the personal information controller with respect to the data collected through the Platform. This means phopin determines the purposes and means of processing your personal data.

Where phopin engages third-party service providers to perform specific processing activities on our behalf — such as payment processing, identity verification, or customer support platforms — those providers act as personal information processors under binding data processing agreements that require them to process data solely on phopin's instructions and in compliance with applicable law.

phopin has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this policy and the DPA. The DPO's contact details are provided in Section 16 of this policy.

3. Data We Collect

phopin collects personal data through several channels, including account registration, deposits and withdrawals, gameplay activity, customer support interactions, and your use of our website and mobile platform. The categories of data we collect are as follows:

3.1 Registration Data

When you create a phopin account, we collect:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Philippine mobile number;
• Email address;
• Username and password (stored in encrypted form).

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and process withdrawals above ₱5,000, we collect:

• Government-issued photo identification (e.g., PhilSys National ID, Passport, Driver's Licence, UMID, SSS ID, PRC ID, Voter's ID);
• Selfie photographs for identity matching purposes;
• Proof of address documentation where required.

3.3 Financial Data

• Deposit and withdrawal transaction records;
• Payment method details (e.g., GCash mobile number, Maya account reference, bank account name and last four digits — full card or account numbers are never stored by phopin);
• Transaction timestamps and amounts.

3.4 Gameplay Data

• Game history, wager amounts, win/loss records;
• Bonus usage and wagering progress;
• Session duration and login timestamps.

3.5 Technical and Device Data

• IP address and approximate geographic location;
• Device type, operating system, and browser version;
• Cookies and session identifiers (see Section 6);
• Referring URL and on-site navigation behaviour.

3.6 Communications Data

• Records of live chat transcripts, email correspondence, and Messenger/Viber interactions with our support team;
• Survey responses and feedback submissions.

4. How We Use Your Data

phopin processes your personal data for the following purposes:

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, phopin processes your personal data on the following legal bases:

• Consent: Where you have given clear, informed consent — for example, when opting in to receive promotional communications or when providing biometric data for KYC purposes.
• Contractual Necessity: Processing that is necessary to perform the contract between you and phopin — including account creation, transaction processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable Philippine law, including anti-money laundering legislation, tax regulations, and PAGCOR regulatory requirements.
• Legitimate Interests: Processing carried out for phopin's legitimate business interests — such as fraud detection, platform security, and service improvement — provided these interests are not overridden by your fundamental rights and freedoms as a data subject.

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Cookies & Tracking Technologies

phopin uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The types of cookies we use are:

• Strictly Necessary Cookies: Required for the Platform to function — including session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without affecting your ability to use phopin.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and last-login details to personalise your experience.
• Analytical Cookies: Collect aggregated, anonymised data about how players navigate the Platform to help us improve performance and usability.
• Marketing Cookies: Used to deliver relevant promotional content based on your activity on phopin. These are only placed with your prior consent.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. For detailed information about the specific cookies in use on phopin, please refer to our Cookie Notice, which is accessible from the Platform's settings menu.

7. Data Sharing & Disclosure

phopin does not sell your personal data. We share your data only in the following circumstances and with the following categories of recipients:

7.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under binding data processing agreements. These include payment processors (GCash, Maya, BPI, BDO, Metrobank, and other payment partners), identity verification and KYC technology providers, cloud hosting and infrastructure providers, customer support platform operators, and fraud detection and cybersecurity partners. All service providers are contractually prohibited from using your data for any purpose other than the specific service they provide to phopin.

7.2 Game Content Providers

phopin's game library is powered by third-party game studios and aggregators. These providers may receive limited technical data — such as session identifiers and wager amounts — necessary to operate their games on the Platform. They do not receive your name, contact details, or payment information.

7.3 Legal and Regulatory Authorities

phopin will disclose personal data to government authorities, law enforcement agencies, or regulators where required by law, court order, or to protect the rights and safety of phopin, its players, or the public. This includes disclosures to the Philippine Anti-Money Laundering Council (AMLC), PAGCOR, and the National Privacy Commission where applicable.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of phopin's assets, your personal data may be transferred to the acquiring entity. We will provide notice via the Platform and email before your data is transferred and becomes subject to a different privacy policy.

8. International Data Transfers

Some of phopin's service providers are located outside the Philippines. Where personal data is transferred to recipients in other countries, phopin ensures that appropriate safeguards are in place in accordance with the Data Privacy Act and NPC guidelines. These safeguards may include:

• Binding contractual clauses that require the recipient to protect data to a standard equivalent to that required under Philippine law;
• Transfer to countries that the NPC has recognised as providing an adequate level of data protection; or
• Other legally recognised transfer mechanisms approved by the NPC.

You may request details of the specific safeguards in place for any international data transfer by contacting phopin's Data Protection Officer at the address listed in Section 16.

9. Data Retention

phopin retains personal data for the period necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. Our standard retention periods are as follows:

After the applicable retention period expires, phopin will securely delete or anonymise your personal data so that it can no longer be associated with you as an individual.

10. Data Security

phopin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. Our key security measures include:

• Encryption in Transit: All data transmitted between your device and phopin's servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Personal data stored on phopin's systems is encrypted using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data undergo background checks and receive regular data privacy training.
• Two-Factor Authentication: phopin strongly recommends that all players enable 2FA on their accounts. Our internal administrative systems require 2FA for all staff access.
• Penetration Testing: Our Platform and infrastructure undergo regular security assessments by independent cybersecurity professionals.
• Incident Response: phopin maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in harm to affected individuals, we will notify the NPC and affected players within the timeframes prescribed by the DPA and NPC regulations.

While phopin takes all reasonable steps to protect your data, no system is completely impenetrable. You are responsible for maintaining the security of your own account credentials. Please notify us immediately at [email protected] if you suspect any unauthorised access to your account.

11. Your Data Subject Rights

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phopin:

To exercise any of the above rights, please contact phopin's Data Protection Officer using the contact details in Section 16. We will respond to all data subject requests within fifteen (15) business days of receipt. In complex cases, this period may be extended by a further fifteen (15) days, in which case we will notify you of the extension and the reason for it.

12. Children's Privacy

The phopin Platform is strictly restricted to individuals who are 21 years of age or older, consistent with the minimum legal age for participation in real-money gambling activities in the Philippines. phopin does not knowingly collect personal data from persons below the age of 21.

If phopin becomes aware that personal data has been collected from a person below the minimum age, the account will be immediately suspended, any deposited funds returned after review, and the personal data associated with the underage account securely deleted in accordance with applicable law.

If you are a parent or guardian and believe that a minor has registered on phopin using false age information, please contact us immediately at the email address listed in Section 16 so that we can take prompt action.

13. Marketing Communications

phopin may send you promotional emails, SMS messages, push notifications, or in-Platform messages about bonuses, new game releases, special events, and personalised offers — but only where you have given your prior, explicit consent to receive such communications during registration or through your account settings.

You can withdraw your consent to marketing communications at any time by:

• Clicking the "unsubscribe" link included in any marketing email;
• Updating your communication preferences in your phopin account settings; or
• Contacting the phopin support team via live chat or email.

Withdrawal of marketing consent does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, account security alerts, and policy update notices — which are sent as part of the phopin service and cannot be individually opted out of while your account remains active.

14. Third-Party Links

The phopin Platform may contain links to third-party websites or resources — for example, links to PAGCOR's responsible gaming resources or payment provider support pages. phopin is not responsible for the privacy practices or content of those external sites. When you navigate away from phopin to a third-party site, we encourage you to review the privacy policy applicable to that site before submitting any personal information.

15. Updates to This Privacy Policy

phopin may revise this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or the features of the Platform. Material changes — particularly those that affect your rights or the way we use your data — will be communicated to you via email or a prominent in-Platform notice at least fourteen (14) days before they take effect.

The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of the phopin Platform after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree with a revised policy, you should stop using the Platform and close your account before the updated policy takes effect.

Prior versions of this Privacy Policy are available on request by contacting phopin's Data Protection Officer.

16. Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by phopin, please contact our designated Data Protection Officer:

• Email: [email protected] (please mark your message "Data Privacy Inquiry")
• Live Chat: Available 24/7 through the phopin Platform — identify yourself and state that you have a data privacy inquiry.
• Messenger & Viber: Available through the official phopin brand pages.

If you are not satisfied with phopin's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC):

phopin commits to acknowledging all data privacy inquiries within three (3) business days and resolving substantive requests within fifteen (15) business days of receipt.