phsaya Privacy Policy

1. Overview and Scope

This Privacy Policy ("Policy") is issued by phsaya ("phsaya", "we", "us", "our") and applies to all personal data processed in connection with your use of the phsaya online casino and sportsbook platform, accessible at phsaya.cam and any related mobile web interfaces (collectively, the "Platform").

phsaya is a PAGCOR-monitored online gaming platform serving Filipino players across the Philippines. In operating the Platform, phsaya acts as a Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012 (Republic Act No. 10173, or "DPA") and its Implementing Rules and Regulations. This Policy describes how phsaya collects, uses, stores, shares, and protects personal data belonging to registered players, prospective users, and visitors to the Platform.

This Policy should be read alongside the phsaya Terms and Conditions and Responsible Gaming Policy, which together govern your relationship with phsaya.

2. Personal Data We Collect

2.1 Registration and Identity Data

When you create a phsaya account, we collect information necessary to establish your identity and verify your eligibility to use the Platform, including:

• Full legal name as it appears on a government-issued Philippine ID;
• Date of birth (to confirm you are at least 21 years of age);
• Gender;
• Current residential address within the Philippines (city, province, zip code);
• Valid Philippine mobile telephone number;
• Email address used for account correspondence and notifications.

2.2 Identity Verification (KYC) Data

As required by PAGCOR and the Anti-Money Laundering Act (AMLA), phsaya conducts Know Your Customer (KYC) verification for all players prior to processing withdrawals. KYC data we collect includes:

• Scanned copy or photograph of a valid Philippine government-issued photo ID (UMID, Driver's License, Passport, PhilSys National ID, PRC ID, or SSS ID);
• Proof of current residential address (utility bill, bank statement, or government-issued correspondence dated within three months);
• Selfie or live photo for identity confirmation, where applicable;
• Additional documents as may be required under enhanced due diligence procedures.

2.3 Financial and Transaction Data

To process deposits and withdrawals through your chosen payment method, phsaya collects and retains:

• Payment method details (GCash registered mobile number, Maya account reference, bank account details for BPI, BDO, Metrobank, UnionBank);
• Transaction history, including deposit amounts, withdrawal requests, timestamps, and payment method used per transaction;
• Currency amounts in Philippine Peso (PHP) or applicable cryptocurrency equivalent;
• Records required for AMLC reporting thresholds under Philippine AML regulations.

2.4 Gaming Activity Data

phsaya records data related to your gaming activity on the Platform for purposes of fair play monitoring, responsible gaming compliance, and service improvement:

• Games played, bet amounts, outcomes, and session durations;
• Sportsbook markets accessed, bet selections, stake amounts, and settlement records;
• Bonus offers claimed, wagering progress, and promotional participation history;
• Session start and end times, gaming frequency patterns, and responsible gaming tool usage.

2.5 Technical and Device Data

When you access the phsaya Platform, our systems automatically collect certain technical data, including:

• IP address and approximate geolocation (to verify Philippine jurisdiction compliance);
• Device type, operating system, and browser version;
• Pages visited, features accessed, and navigation patterns within the Platform;
• Session identifiers, cookies, and similar tracking technologies (see Section 9).

2.6 Communications Data

Records of your communications with phsaya, including live chat transcripts, email correspondence, and any formal complaints submitted through the Platform's support channels, are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

3. How We Collect Your Data

phsaya collects personal data through the following means:

• Directly from you — through the account registration form, KYC document submission process, deposit and withdrawal requests, live chat and email support interactions, and participation in promotions;
• Automatically — through cookies, session tracking, server logs, and similar technologies when you access and use the Platform;
• From payment service providers — transaction confirmation data from GCash, Maya, BPI, BDO, and other integrated payment gateways, to the extent necessary to verify deposit and withdrawal processing;
• From identity verification services — where phsaya uses third-party KYC or fraud prevention tools, data returned from these services in connection with your submitted identity documents;
• From regulatory bodies — data shared by PAGCOR or the AMLC in connection with compliance obligations.

4. Purpose of Processing Your Personal Data

phsaya processes your personal data for the following purposes:

• Account management — creating, maintaining, and securing your phsaya player account;
• Identity and age verification — confirming you are at least 21 years of age and legally eligible to use the Platform under Philippine law;
• Payment processing — executing deposits and withdrawals through your chosen payment method;
• Regulatory compliance — fulfilling obligations under PAGCOR gaming regulations, the Anti-Money Laundering Act, and the Data Privacy Act;
• Fraud prevention and security — detecting and preventing unauthorized account access, fraudulent transactions, and prohibited activities on the Platform;
• Responsible gaming — monitoring gaming activity to identify problem gambling patterns and applying responsible gaming tools where triggered;
• Customer support — responding to your queries, resolving disputes, and improving support service quality;
• Promotions and communications — sending bonus offers, platform updates, and promotional communications (where you have consented or where it is otherwise lawful);
• Platform improvement — analyzing aggregated usage data to improve Platform performance, game selection, and user experience;
• Legal proceedings — where necessary, using personal data to enforce phsaya's Terms and Conditions or defend against legal claims.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012, phsaya processes your personal data on the following lawful bases:

• Contractual necessity — processing required to perform our obligations under the phsaya Terms and Conditions, including account management, payment processing, and game provision;
• Legal obligation — processing required to comply with Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act, and NPC data protection requirements;
• Legitimate interests — processing for fraud prevention, platform security, and service improvement, where these interests are not overridden by your rights as a data subject;
• Consent — processing for marketing communications and optional data uses, where you have provided explicit, freely given, and informed consent that you may withdraw at any time.

6. Data Sharing and Disclosure

6.1 Third Parties We Share Data With

phsaya does not sell your personal data to third parties. We share your data only where necessary for the purposes described in this Policy, and only with the following categories of recipients:

• Payment service providers — GCash (Mynt), Maya, BPI, BDO, Metrobank, UnionBank, and other integrated payment gateways, for the sole purpose of processing your transactions;
• KYC and identity verification providers — third-party services engaged to assist with document verification, where applicable;
• Game software providers — to the extent necessary for game session validation and RNG certification, game providers may receive anonymized or pseudonymized session data;
• Regulatory and law enforcement authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies, where we are legally required to disclose information;
• IT and infrastructure providers — cloud hosting, data storage, and cybersecurity service providers engaged to support Platform operations, bound by data processing agreements consistent with this Policy.

6.2 International Data Transfers

Where phsaya engages service providers located outside the Philippines (for example, cloud infrastructure or game software providers), personal data may be transferred internationally. In such cases, phsaya ensures that appropriate safeguards are in place — including contractual data processing agreements that require recipient parties to maintain standards consistent with the Data Privacy Act of 2012 — before any transfer is made.

7. Data Retention

phsaya retains personal data for as long as is necessary to fulfill the purposes for which it was collected, and as required by applicable Philippine law. Specific retention periods include:

• Account data — retained for the duration of your account registration and for a period of five (5) years following account closure, in accordance with PAGCOR and AMLC record-keeping requirements;
• KYC documents — retained for five (5) years from the date of submission or from the date of the last transaction, whichever is later, as required under AML regulations;
• Transaction records — retained for five (5) years in accordance with AMLC regulations and standard financial record-keeping requirements;
• Gaming activity logs — retained for three (3) years for responsible gaming monitoring and dispute resolution purposes;
• Support communications — retained for two (2) years for quality assurance and dispute resolution purposes;
• Cookie and technical data — retained for periods described in Section 9 of this Policy.

Following the applicable retention period, personal data is securely deleted or anonymized in a manner that prevents re-identification. Where retention is required for ongoing legal proceedings or regulatory investigations, data will be retained until the matter is fully resolved.

8. Data Security Measures

phsaya implements technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:

• SSL/TLS encryption — all data transmitted between your device and phsaya's servers is encrypted using industry-standard 256-bit SSL/TLS protocols;
• Two-factor authentication (2FA) — SMS OTP verification available to all registered players as an additional account protection layer;
• Access controls — access to personal data within phsaya's systems is restricted to authorized personnel on a strict need-to-know basis, with role-based access controls and audit logging;
• Data storage security — personal data is stored on secure servers with firewall protection, intrusion detection systems, and regular security audits;
• Employee training — phsaya personnel with access to personal data receive mandatory data privacy and security training;
• Incident response — phsaya maintains a data breach response procedure, including NPC notification protocols in accordance with the DPA's seventy-two (72)-hour breach notification requirement where applicable.

While phsaya employs robust security measures, no digital platform is entirely immune to security risks. You are responsible for maintaining the security of your own account credentials and for notifying phsaya immediately of any suspected unauthorized access to your account.

9. Cookies and Tracking Technologies

9.1 Types of Cookies Used

phsaya uses the following categories of cookies and similar tracking technologies:

• Strictly necessary cookies — essential for Platform operation, including session management, login state maintenance, and security functions. These cannot be disabled without impairing Platform functionality;
• Functional cookies — remember your preferences such as language settings and game lobby configuration to improve your Platform experience;
• Analytics cookies — collect aggregated, anonymized data on how players use the Platform to help phsaya improve features and performance. phsaya uses privacy-respecting analytics tools and does not share individual-level analytics data with third parties for advertising purposes;
• Security cookies — assist phsaya's fraud detection systems in identifying suspicious access patterns and protecting account integrity.

9.2 Managing Cookies

You can control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to be notified before a cookie is stored. Note that disabling certain functional cookies may affect your ability to use some features of the phsaya Platform. phsaya does not currently respond to "Do Not Track" browser signals, but we respect all cookie preferences you set directly through your browser.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by phsaya:

To exercise any of your data subject rights, please contact phsaya's Data Protection Officer through the support channels listed in Section 13. phsaya will respond to rights requests within a reasonable timeframe in accordance with the DPA's requirements, and may request identity verification before processing your request.

11. Protection of Minors

The phsaya Platform is strictly for individuals aged 21 years and above, as required under PAGCOR regulations governing online gaming in the Philippines. phsaya does not knowingly collect, process, or retain personal data from individuals under the age of 21.

Age verification is conducted as part of the account registration and KYC process. Where phsaya discovers that personal data has been collected from a person under 21 years of age, we will immediately close the associated account, securely delete the personal data to the extent permitted by law, and take any regulatory reporting actions required under applicable PAGCOR or Philippine law requirements.

If you have reason to believe that a minor has registered on the phsaya Platform, please notify us immediately through the contact details in Section 13.

12. Changes to This Privacy Policy

phsaya reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. Material changes to this Policy will be communicated to registered players via email to your registered address and/or via a notice displayed upon your next login to the phsaya Platform.

The date of the most recent update to this Policy is displayed at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the phsaya Platform following notification of changes constitutes your acknowledgment of the updated Policy. If you object to any changes, you may close your account and request erasure of your personal data to the extent permitted under our retention obligations.

13. Contact and Complaints

phsaya has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and the Data Privacy Act of 2012. If you have any questions, concerns, or complaints regarding phsaya's handling of your personal data, or if you wish to exercise any of your data subject rights described in Section 10, please contact us through the following channels:

• Live Chat: Available 24/7 within the phsaya Platform dashboard after login — the fastest way to reach our support and data privacy team;
• Email: [email protected] — please include "Data Privacy Request" or "DPO" in your subject line for routing to the appropriate team.

phsaya will acknowledge receipt of your privacy-related inquiry within three (3) business days and will endeavor to resolve the matter within fifteen (15) business days. For complex requests, we will keep you informed of our progress.

If you are not satisfied with phsaya's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the regulatory authority responsible for enforcing the Data Privacy Act. Complaints to the NPC should be filed after first attempting to resolve the matter directly with phsaya's DPO.