ph45 Privacy Policy — How We Protect Your Personal Data

The data controller responsible for the personal data you provide to ph45 is the legal entity operating the ph45 online gaming platform at ph45.asia ("ph45," "we," "us," or "our"), a company duly licensed by the Philippine Amusement and Gaming Corporation (PAGCOR) to operate online gaming services in the Philippines.

As data controller, ph45 determines the purposes for which your personal data is collected and the means by which it is processed. ph45 is registered as a personal data controller with the National Privacy Commission (NPC) of the Philippines, as required by Republic Act No. 10173 (Data Privacy Act of 2012) and its implementing rules.

All data processing activities conducted by ph45 are subject to the Data Privacy Act of 2012, NPC Circular 16-01 and related issuances, and applicable PAGCOR data governance directives.

ph45 collects personal data across several stages of your relationship with the platform. The table below summarises the categories of data collected, the source of each category, and the primary purpose:

ph45 uses the personal data described in Section 2 for the following specific purposes:

3.1 Account Management

Your identity and contact data is used to create and maintain your ph45 account, authenticate your login sessions, send account notifications via SMS (including OTPs), and manage your account settings and preferences.

3.2 KYC and Regulatory Compliance

Government ID data and biometric data are used exclusively to verify your identity and age, as required by PAGCOR regulations, the Philippine Anti-Money Laundering Act (RA 9160, as amended), and related AMLC issuances. Verified KYC data is retained as required by Philippine financial crime prevention law.

3.3 Payment Processing

Financial data is used to process deposits and withdrawals through your selected payment method (GCash, Maya, BPI, BDO, Metrobank, GrabPay, 7-Eleven CLiQQ, or USDT), to comply with AMLA transaction monitoring obligations, and to apply the same-source withdrawal rule required by anti-money laundering regulations.

3.4 Game Operation and Fair Play

Gaming activity data is used to operate the games you play, resolve disputes about game outcomes, calculate and pay winnings, process bonus awards and wagering requirement tracking, and generate the account history accessible from your dashboard.

3.5 Fraud Prevention and Security

Technical data, IP addresses, and device fingerprints are used to detect and prevent fraudulent account creation, credential stuffing attacks, duplicate account registration, payment fraud, bonus abuse, and other prohibited conduct described in the ph45 Terms & Conditions.

3.6 Responsible Gaming Monitoring

Gaming activity data and behavioural data are used to monitor for signs of problem gambling behaviour, to enforce the deposit limits, session limits, and self-exclusion settings you have activated, and to comply with PAGCOR's responsible gaming requirements. ph45's responsible gaming system operates automatically and does not involve manual review of your gaming behaviour for commercial profiling.

3.7 Customer Support

Support data, including chat transcripts and complaint records, is used to resolve your support inquiries, maintain quality assurance records, and train ph45 support staff. All support interactions are recorded and retained for a minimum of 2 years.

3.8 Platform Improvement

Aggregated and anonymised behavioural data is used to analyse platform performance, identify usability issues, test new features, and improve the overall ph45 experience. This analysis operates on aggregated data and does not result in decisions affecting individual users.

3.9 Marketing Communications (Opt-In Only)

With your explicit consent, ph45 may use your contact data to send promotional offers, bonus notifications, and platform news via SMS. You may withdraw this consent at any time through your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of prior processing.

Under the Philippine Data Privacy Act, all personal data processing must have a lawful basis. ph45 relies on the following legal bases for its processing activities:

• Contractual necessity: Processing necessary to fulfil the contract between ph45 and the User — including operating your account, processing payments, and providing game services. This is the primary basis for most processing activities at ph45.
• Legal obligation: Processing necessary to comply with PAGCOR regulations, the Anti-Money Laundering Act, NPC requirements, and other applicable Philippine law. This includes KYC data collection, transaction records, and mandatory AMLC reporting.
• Legitimate interests: Processing necessary for ph45's legitimate interests in fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your data protection rights. ph45 has conducted legitimate interest assessments for each processing activity relying on this basis.
• Consent: Processing based on your explicit, freely given, specific, and informed consent — primarily for marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

ph45 does not process sensitive personal information (such as biometric data) without explicit consent and a clearly identified legal basis, in accordance with Section 13 of RA 10173.

ph45 does not sell, rent, or trade your personal data to third parties for commercial purposes. Your data may be shared in the following circumstances only:

5.1 Service Providers (Data Processors)

ph45 engages third-party service providers who process personal data on ph45's behalf under data processing agreements that contractually obligate them to process data only for the purposes specified by ph45 and in compliance with RA 10173. These include:

• KYC technology providers — for identity and age verification processing
• Payment processors — GCash, Maya, BPI, BDO, Metrobank, GrabPay, 7-Eleven, and USDT network processors for transaction execution
• Cloud infrastructure providers — for secure data storage and platform hosting
• Game content providers — JILI, Evolution, Pragmatic Play, and other licensed game studios receive limited session and wagering data necessary to operate game rounds
• Fraud detection providers — for real-time risk scoring and device fingerprinting

5.2 Regulatory Authorities

ph45 is required to disclose personal data to PAGCOR and the Anti-Money Laundering Council (AMLC) upon request, in compliance with gaming regulations and Philippine AMLA law. ph45 has no discretion to refuse lawful regulatory disclosure requests from these authorities.

5.3 Law Enforcement

ph45 may disclose personal data to Philippine law enforcement authorities (PNP, NBI) or courts where required by a valid legal order, subpoena, or warrant. ph45 will notify affected users of such disclosures where legally permitted to do so.

5.4 Business Transfers

In the event of a merger, acquisition, or transfer of ph45's business assets, personal data held by ph45 may be transferred to the successor entity as part of that transaction. Users will be notified of any such transfer in advance of the data being transferred, and the successor entity will be bound by equivalent data protection obligations.

Some of ph45's third-party service providers — particularly cloud infrastructure providers and international game studios — are located outside the Philippines. When personal data is transferred to recipients outside the Philippines, ph45 ensures that appropriate safeguards are in place as required by NPC Circular 16-01 and Section 21 of RA 10173.

Safeguards for international transfers include:

• Contractual clauses in data processing agreements that impose obligations equivalent to RA 10173 on overseas processors.
• Transfers only to jurisdictions that the NPC has determined provide an adequate level of protection, or where adequacy is contractually established.
• Regular audits of overseas processors' data protection practices.

ph45 does not transfer personal data internationally beyond what is strictly necessary for the service functions described in Section 5.1. Sensitive personal information — including biometric data collected during KYC — is processed within Philippine-jurisdiction or equivalent-protection infrastructure only.

ph45 retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, ph45 will securely delete or anonymise your personal data in accordance with NPC-approved disposal methods. Anonymised data that can no longer be linked to you as an individual is not subject to these retention limits and may be retained indefinitely for aggregated analytics purposes.

ph45 uses cookies and similar tracking technologies on the ph45 website. A cookie is a small text file stored on your device by your browser when you visit a website. ph45 uses the following categories of cookies:

8.1 Strictly Necessary Cookies

These cookies are essential for the ph45 platform to function. They maintain your login session, remember your security settings, and enable core platform features. These cookies cannot be disabled — the platform will not function correctly without them. They do not collect information used for marketing.

8.2 Performance and Analytics Cookies

These cookies collect anonymised information about how users navigate the ph45 platform — which pages are visited most frequently, where errors occur, and how long sessions last. This data is aggregated and used solely to improve platform performance. ph45 uses self-hosted analytics tools and does not use Google Analytics or other third-party analytics services that transfer data outside the ph45 infrastructure.

8.3 Functional Cookies

These cookies remember your preferences — such as your language settings, game lobby filter preferences, and responsible gaming reminder intervals — to provide a more personalised experience. They do not track your browsing on other websites.

8.4 Managing Cookies

You can control cookie settings through your browser preferences. Disabling strictly necessary cookies will prevent the ph45 platform from functioning correctly. Disabling performance and functional cookies will not prevent you from using the platform, but may affect your experience. ph45 does not use third-party advertising or retargeting cookies.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights as a data subject. These rights are enforceable and ph45 has formal procedures to honour each of them:

ph45 does not knowingly collect or process personal data of any person under 21 years of age. The ph45 platform is not designed for, marketed to, or intended for use by minors or any person below the legal gambling age in the Philippines.

If ph45 discovers that personal data has been collected from a person under 21 — whether through account registration misrepresentation or any other means — the following will occur immediately:

• The account will be permanently closed.
• All data collected from the underage individual will be deleted from ph45's active systems, subject to any mandatory legal reporting obligations.
• Deposited funds will be returned to the depositing payment method after verification of the refund recipient's identity.
• The incident will be reported to PAGCOR in accordance with applicable regulatory requirements.

If you are a parent or guardian and believe that a minor in your care has registered at ph45, contact ph45's Data Protection Officer immediately at the details in Section 15. We will take immediate action to address the situation.

ph45 implements a multi-layered security framework that is regularly reviewed, tested, and updated to address emerging threats. Key security measures include:

• Encryption in transit: All communications between your device and ph45 servers use TLS 1.3 encryption — the current industry standard, equivalent to that used by Philippine digital banks.
• Encryption at rest: Personal data stored in ph45 databases is encrypted using AES-256 encryption. Encryption keys are managed using a dedicated key management system with access restricted to authorised systems only.
• Access controls: Employee access to personal data is granted on a strict need-to-know basis using role-based access control (RBAC). Access is logged, monitored, and regularly audited. Access privileges are reviewed quarterly and revoked immediately upon role change or departure.
• Multi-factor authentication: All ph45 staff with access to personal data systems are required to use multi-factor authentication. Administrative access requires hardware security key authentication.
• Network security: ph45 infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and DDoS mitigation services. The platform undergoes regular penetration testing by independent security firms.
• Vulnerability management: ph45 operates a continuous vulnerability scanning programme and applies security patches within defined timelines based on severity classification.
• Physical security: Data centre facilities used by ph45 comply with ISO 27001 physical security standards, including biometric access controls, CCTV monitoring, and environmental controls.
• Staff training: All ph45 employees with access to personal data complete mandatory data privacy and security training annually and upon hire, as required by NPC regulations.

Despite ph45's comprehensive security measures, no system is completely immune to security incidents. In the event of a personal data breach that poses a real risk of serious harm to affected data subjects, ph45 will:

1. Contain the breach immediately upon detection — isolating affected systems, revoking compromised credentials, and preserving forensic evidence.
2. Assess the breach within 24 hours — evaluating the nature of the data involved, the number of affected individuals, and the likely consequences for those individuals.
3. Notify the NPC within 72 hours of becoming aware of the breach, as required by NPC Circular 16-03, providing all information reasonably available at that time. A complete report will follow within 5 days.
4. Notify affected data subjects via SMS to their registered mobile number — without undue delay and within 72 hours where technically feasible — describing the nature of the breach, the data involved, and what steps are being taken to mitigate harm. Notification will include practical guidance on steps affected individuals can take to protect themselves.
5. Conduct a post-incident review to identify root causes, implement remediation measures, and update security controls to prevent recurrence.

ph45 may send promotional communications — including bonus offers, new game announcements, and platform news — only to players who have explicitly opted in to receive such communications during registration or subsequently through their account settings.

ph45 uses SMS as its primary marketing communication channel. Promotional emails, if used, require a separate explicit opt-in. ph45 does not send push notifications without opt-in consent.

13.1 Opt-In and Opt-Out

You can opt in to or opt out of marketing communications at any time through your ph45 Account Settings under "Communication Preferences." Opt-out requests take effect within 48 hours. After opting out, you will continue to receive transactional communications (OTPs, payment notifications, security alerts, account updates) which are necessary for account operation and cannot be disabled.

13.2 No Third-Party Marketing

ph45 does not share your personal data with third parties for their direct marketing purposes. ph45 does not engage in third-party advertising networks or behavioural retargeting. Any promotional communication you receive will be from ph45 directly — not from third-party marketers using ph45 data.

13.3 Self-Excluded Players

Players who have activated self-exclusion on their ph45 account are automatically removed from all marketing communication lists immediately upon activation of self-exclusion. ph45 will not send any promotional or re-engagement communications to self-excluded players for the duration of their exclusion period.

ph45 may update this Privacy Policy from time to time to reflect changes in applicable law, NPC issuances, PAGCOR requirements, or ph45's data processing practices. The version date and effective date are displayed at the top of this document.

For material changes — those that significantly affect your rights or the way ph45 processes your personal data — ph45 will:

• Display a prominent notice on the ph45 website for a minimum of 14 days prior to the effective date.
• Send an SMS notification to your registered mobile number describing the nature of the changes.
• Display an in-platform notice upon your next login.

Your continued use of the ph45 platform after the effective date of an updated Privacy Policy constitutes your acknowledgment of the changes. The current version of this Privacy Policy is always available at ph45.asia/privacy-policy.

For non-material changes — such as corrections, clarifications, or updates to contact details — ph45 may update the policy without prior notice, updating the version date to reflect the change.

ph45 has designated a Data Protection Officer (DPO) as required by Section 21 of RA 10173. The DPO is your primary point of contact for all data privacy matters, including data subject rights requests, privacy complaints, and inquiries about this Privacy Policy.

15.1 Submitting a Data Subject Request

To exercise any of the rights described in Section 9, or to submit a privacy-related inquiry or complaint, contact the ph45 DPO. Your request must include:

• Your full legal name as registered with ph45
• Your registered ph45 mobile number
• A copy of one valid government-issued ID for identity verification
• A clear description of your request or complaint

ph45 will acknowledge receipt of your request within 3 business days and provide a substantive response within 30 calendar days. If your request requires extended processing time, ph45 will notify you of the delay and the expected completion date.

15.2 NPC Complaints

If you are not satisfied with ph45's response to your data privacy complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent supervisory authority responsible for enforcing RA 10173. Information on how to file a complaint with the NPC is publicly available on the NPC's official website.

This Privacy Policy was last reviewed and updated on 1 January 2026. ph45 Casino — ph45.asia. PAGCOR regulated. Philippine Data Privacy Act (RA 10173) compliant. 21+ only.