Privacy Policy — How phil99 Collects, Uses & Protects Your Data

1. Introduction

This Privacy Policy ("Policy") is issued by phil99 ("phil99", "we", "us", "our") and applies to all personal data collected through the phil99 online gaming platform, accessible at https://phil99.cam and all associated sub-domains, mobile interfaces, and related digital services (collectively, "the Platform").

phil99 is committed to protecting the privacy and personal data of every player. This Policy is designed to be clear, honest, and complete — not a wall of legalese written to obscure what's actually happening with your data. We want every Filipino player who registers and plays at phil99 to understand exactly how their information is handled, and to feel confident that it is protected appropriately.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference and together form the complete legal framework governing your use of the phil99 platform.

2. Data Controller

For the purposes of applicable data protection legislation, phil99 is the data controller responsible for the personal data you provide when registering an account or using the Platform. As data controller, phil99 determines the purposes for which and the manner in which your personal data is processed.

phil99 operates its platform in alignment with the standards and obligations applicable to online gaming operators, including data handling obligations relevant to players based in the Philippines. For any privacy-related queries or to exercise your data rights, please contact phil99 using the details provided in Section 16 of this Policy.

3. Personal Data We Collect

phil99 collects the following categories of personal data from players, either directly upon registration or in the course of using the Platform:

3.1 Identity & Registration Data

• Full legal name as it appears on a government-issued Philippine ID;
• Date of birth (used to verify the minimum age of 21 years);
• Registered mobile number (Philippine mobile number required);
• Username and account credentials (password stored in hashed, non-reversible form);
• Gender (where provided voluntarily during registration).

3.2 Identity Verification (KYC) Data

• Copies of government-issued Philippine photo identification documents (e.g., PhilSys National ID, passport, driver's licence, UMID, SSS ID, or voter's ID);
• Proof of address documentation where required by applicable AML or KYC obligations;
• Selfie or facial verification image where required to confirm document authenticity.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• GCash, Maya, or bank account identifiers used for deposits and withdrawals (account numbers are stored in tokenised or masked form);
• Bonus and promotional redemption history;
• Account balance history.

3.4 Gaming Activity Data

• Game session records including game titles played, bet amounts, win/loss outcomes, and session duration;
• Game preferences and favourite game selections;
• Responsible gaming settings including any deposit limits, session limits, or self-exclusion requests applied to your account.

3.5 Technical & Device Data

• IP address and approximate geolocation (country and region level);
• Device type, operating system, browser type and version;
• Cookie identifiers and session tokens;
• Platform login timestamps and session durations;
• Referral source and traffic origin data where applicable.

3.6 Communications Data

• Records of communications with the phil99 customer support team, including live chat transcripts and support ticket histories;
• Email correspondence where applicable;
• Survey responses and feedback submitted voluntarily.

4. How We Collect Your Data

phil99 collects personal data through the following channels:

• Directly from you — when you register an account, complete identity verification, make a deposit or withdrawal, contact support, or respond to a survey;
• Automatically through the Platform — technical data including IP addresses, device identifiers, session information, and cookie data is collected automatically when you access and use the Platform;
• From payment providers — transaction confirmation data is received from GCash, Maya, and other payment processors when you deposit or withdraw funds;
• From identity verification partners — where third-party KYC service providers are used to assist with document verification, relevant verification outcome data may be received;
• From fraud prevention and security systems — data from automated security monitoring tools used to detect and prevent fraud, money laundering, and account takeover attempts.

5. Why We Use Your Personal Data

The following table summarises the primary purposes for which phil99 processes your personal data:

6. Legal Basis for Processing

phil99 processes your personal data on the following legal grounds:

• Contract Performance: Processing is necessary to operate your phil99 account, process transactions, and deliver the services you have signed up for.
• Legal Obligation: phil99 is required by applicable law to collect and retain certain data, particularly for age verification, KYC, anti-money laundering (AML) compliance, and regulatory reporting.
• Legitimate Interests: phil99 processes certain data on the basis of its legitimate interests in operating a secure, fraud-free platform and improving its services, provided those interests are not overridden by your data protection rights.
• Consent: Where processing requires your explicit consent — particularly for direct marketing communications — phil99 will request and record your consent separately. You may withdraw consent at any time.

7. Data Sharing & Disclosure

phil99 does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Processors: GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph, and other payment service providers receive transaction data necessary to process your deposits and withdrawals;
• Game Providers: Licensed game studios (e.g., JILI, Pragmatic Play, Evolution Gaming, PG Soft) may receive limited technical session data necessary to operate their games within the phil99 platform;
• KYC & Identity Verification Partners: Third-party identity verification services may receive identity document data for the purpose of completing your account verification;
• Fraud Prevention & Security Partners: Specialist fraud detection and cybersecurity service providers may receive technical and transaction data to assist in detecting and preventing fraudulent activity;
• Regulatory & Law Enforcement Authorities: phil99 may be required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine government authorities in compliance with applicable legal obligations;
• Professional Advisers: Legal advisers, accountants, and auditors may access personal data on a confidential, need-to-know basis in the course of providing professional services to phil99.

8. International Data Transfers

Certain data processing operations — particularly those involving game providers, payment processors, and cloud infrastructure providers — may involve the transfer of personal data to servers or service providers located outside the Philippines. Where such transfers occur, phil99 takes appropriate steps to ensure that your personal data remains subject to adequate levels of protection, including the use of contractual safeguards, data processing agreements, and transfer mechanisms consistent with applicable data protection standards.

By registering an account with phil99, you acknowledge that your personal data may be transferred, stored, and processed in locations outside the Philippines in the circumstances described above.

9. Data Retention

phil99 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following general retention principles apply:

• Account Data: Retained for the duration of your account's active status and for a minimum period following account closure, as required by financial recordkeeping and AML obligations;
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with AML regulatory requirements applicable in the Philippines;
• Transaction Records: Retained for a minimum of five (5) years for regulatory and audit purposes;
• Support Communications: Retained for up to three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes;
• Technical & Device Data: Session logs retained for up to twelve (12) months for security monitoring purposes; anonymised analytics data may be retained indefinitely;
• Marketing Preferences: Retained until you withdraw consent or request deletion.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. If you request earlier deletion and no overriding legal obligation requires continued retention, phil99 will action the deletion request within a reasonable timeframe.

10. Security Measures

phil99 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the phil99 platform;
• Passwords stored using strong, industry-standard one-way hashing algorithms — plain-text passwords are never stored;
• Optional two-factor authentication (2FA) via SMS OTP for account access;
• Access controls and role-based permissions limiting staff access to personal data on a strict need-to-know basis;
• Automated anomaly detection and fraud monitoring systems operating continuously;
• Regular security assessments and vulnerability testing of platform infrastructure;
• Incident response procedures for managing and reporting data security incidents in the event they occur.

While phil99 takes data security seriously and implements appropriate safeguards, no digital platform can guarantee absolute security. In the unlikely event of a data breach that poses a risk to your rights and interests, phil99 will notify affected players as required by applicable law.

11. Cookies & Tracking Technologies

phil99 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit the Platform. They allow phil99 to recognise your browser, maintain your session state, remember your preferences, and gather analytics data.

11.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and fraud prevention identifiers. These cannot be disabled without affecting Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, game favourites, and display options. These improve your experience but are not strictly required.
• Analytics Cookies: Used to collect anonymised data about how players use the Platform — pages visited, session durations, and feature usage. This data is used to improve the Platform experience.
• Marketing Cookies: Used only where you have consented to receive personalised marketing communications. These may track interactions with promotional content.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. For other cookie types, you may opt out at any time without affecting core platform access.

12. Minors & Age Policy

The phil99 platform is strictly intended for adults aged 21 years and above, in compliance with PAGCOR regulations governing online casino gaming in the Philippines. phil99 does not knowingly collect personal data from individuals under the age of 21.

Age verification is a mandatory step in the account registration and KYC process. If phil99 discovers or has reasonable grounds to believe that a registered account belongs to a person under the age of 21, the account will be suspended immediately, all balances will be frozen pending investigation, and the personal data associated with the account will be processed only to the extent required by applicable law before being deleted.

13. Your Data Rights

As a player on the phil99 platform, you hold a number of rights in relation to your personal data. phil99 is committed to facilitating the exercise of these rights in a timely and transparent manner. The following rights apply:

To exercise any of the above rights, please contact the phil99 Data Privacy team using the contact details provided in Section 16. phil99 will respond to all data rights requests within a reasonable timeframe and in accordance with applicable law.

14. Marketing Communications

phil99 may send you promotional communications, bonus offers, game announcements, and platform updates through SMS and other appropriate channels, but only where you have explicitly opted in to receive such communications during registration or through your account settings.

You may opt out of marketing communications at any time by updating your notification preferences in your phil99 account settings, or by contacting the support team directly. Opting out of marketing communications will not affect transactional communications required for the operation of your account (e.g., deposit confirmations, withdrawal notifications, security alerts, and OTPs).

15. Changes to This Privacy Policy

phil99 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they meaningfully affect how your data is collected, used, or shared — phil99 will notify you through the Platform interface or via your registered mobile number, and will update the "Last Updated" date at the top of this Policy.

Your continued use of the phil99 Platform following notification of changes constitutes your acceptance of the updated Policy. If you do not accept the changes, you must cease using the Platform and may request closure of your account and deletion of your data, subject to applicable legal retention obligations.

16. Contact & Data Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the exercise of your data protection rights, please contact the phil99 customer and data privacy support team:

Please include "Privacy Request" or "Data Rights Request" in the subject line of your communication, along with your registered account details, to help us process your enquiry promptly. phil99 aims to acknowledge all privacy-related requests within 72 hours and to resolve them within a reasonable timeframe consistent with applicable law.