phmac Privacy Policy

1Introduction

phmac ("we", "us", "our") is an online casino and sports betting platform operated for and dedicated to Filipino players. We are committed to protecting the privacy and personal data of every individual who interacts with the phmac platform, whether as a registered player, a visitor to our website, or a prospective user.

This Privacy Policy applies to all personal data collected and processed by phmac in connection with the operation of the phmac website at phmac.net, including all subdomains, mobile-optimised interfaces, and any associated applications or tools through which phmac services are accessed.

phmac processes personal data in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC). Where applicable, phmac also observes the data protection principles prescribed by PAGCOR in the context of regulated gaming operations.

By accessing or using any part of the phmac platform after this policy's effective date, you confirm that you have read and agreed to the data processing practices described herein. If you do not agree, please discontinue use of the phmac platform and contact us to close your account.

2Personal Data We Collect

phmac collects personal data across several categories, depending on how you interact with our platform. The categories of personal data we may collect include, but are not limited to, the following:

phmac does not intentionally collect sensitive personal information beyond what is strictly required for identity and age verification under PAGCOR requirements and Philippine anti-money laundering obligations. Where sensitive personal information is collected — such as a government ID that may reveal religion or ethnicity — it is processed solely for verification purposes and is not used for any other purpose.

3How We Collect Your Data

phmac collects personal data through the following primary channels:

• Direct submissions: Information you provide when you register a phmac account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or respond to a promotional survey or feedback form.
• Automated technical collection: Data collected automatically when you access the phmac website, including IP address, device identifiers, browser fingerprint, session duration, pages visited, and click behaviour. This is collected via server logs, cookies, and similar tracking technologies described in Section 7.
• Payment providers: When you make a deposit or withdrawal using GCash, Maya, GrabPay, BPI, BDO, Metrobank, or any other supported Philippine payment channel, we receive transaction confirmation data and, where required for AML compliance, additional payment account information from the payment provider.
• Identity verification partners: phmac may use third-party KYC and identity verification service providers to assist in processing and verifying the documents you submit. These providers process your data under strict contractual obligations consistent with this Privacy Policy.
• Publicly available sources: In limited circumstances related to fraud prevention or AML compliance, phmac may cross-reference information you provide against publicly available data sources or government watchlists, in accordance with applicable Philippine law.

4How We Use Your Personal Data

phmac uses the personal data we collect for the following specific purposes:

• Account creation and management: To create, maintain, and secure your phmac player account, including authenticating your identity each time you log in.
• Age and identity verification (KYC): To confirm that you meet the minimum age of 21 years required under PAGCOR regulations before permitting access to real-money gaming features.
• Payment processing: To process your deposits and withdrawal requests via your chosen Philippine payment method, and to maintain accurate financial records for reconciliation and audit purposes.
• Anti-money laundering (AML) compliance: To monitor transactions for suspicious activity, fulfil mandatory reporting obligations to the Anti-Money Laundering Council (AMLC), and comply with Republic Act No. 9160 (Anti-Money Laundering Act).
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and deliver effective support in English and Filipino.
• Platform personalisation: To tailor the phmac gaming experience to your preferences, including game recommendations, promotional offers relevant to your activity, and language or currency settings.
• Fraud prevention and security: To detect and prevent fraudulent account activity, bonus abuse, collusion, multi-accounting, and other prohibited conduct as defined in the phmac Terms & Conditions.
• Responsible gaming: To monitor gaming behaviour for signs of problem gambling and to enforce self-exclusion requests, deposit limits, and cooling-off periods activated by you or imposed by phmac in accordance with our responsible gaming obligations.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only if you have opted in to receive such communications. You may withdraw consent at any time.
• Legal and regulatory compliance: To meet all obligations imposed on phmac by applicable Philippine law, PAGCOR regulations, AMLC requirements, and any other competent regulatory or law enforcement authority.

5Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, phmac processes your personal data on one or more of the following lawful bases:

• Contractual necessity: Processing required to fulfil the contract between you and phmac — i.e., delivering the gaming platform, processing payments, and managing your account — is carried out on the basis that it is necessary to perform the services you have signed up for.
• Legal obligation: Processing required to comply with Philippine laws, including PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable regulations, is carried out on the basis of legal obligation.
• Legitimate interests: Certain processing activities — including fraud detection, security monitoring, platform analytics, and responsible gaming monitoring — are carried out on the basis of phmac's legitimate interests, provided those interests are not overridden by your data protection rights.
• Consent: Where phmac processes your data for marketing communications or non-essential cookies, this is done on the basis of your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6Data Sharing & Third-Party Disclosure

phmac does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your personal data may be shared with third parties only in the following strictly defined circumstances:

• Service providers and processors: phmac engages carefully selected third-party service providers to assist in delivering platform functions, including KYC and identity verification providers, payment gateway operators (GCash, Maya, BPI, BDO, Metrobank, and others), customer support software providers, IT infrastructure and cloud hosting partners, and fraud detection and cybersecurity specialists. All such providers are bound by contractual data processing agreements that require them to handle your data securely and only for the purposes specified.
• Regulatory and law enforcement authorities: phmac is required by Philippine law to disclose certain personal and transactional data to PAGCOR, the AMLC, the National Privacy Commission, and other competent government bodies where legally required to do so. phmac will comply with valid legal orders, court orders, and regulatory directives without prior notice to the affected player where the law requires or permits non-disclosure.
• Responsible gaming bodies: In cases where a player activates self-exclusion, phmac may share necessary information with relevant responsible gaming registries or industry self-exclusion schemes operating in the Philippines to ensure effective enforcement of the exclusion.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of phmac's business, your personal data may be transferred to the successor entity as part of the transaction. phmac will notify affected players of any such transfer and the privacy implications before it takes effect.

7Cookies & Tracking Technologies

phmac uses cookies and similar tracking technologies on the phmac website to deliver a functional, personalised, and secure gaming experience. A cookie is a small text file placed on your device when you visit a website. phmac uses the following categories of cookies:

You can manage your cookie preferences through your browser settings or via phmac's cookie consent interface. Please note that disabling non-essential cookies may affect certain personalisation features of the phmac platform. Strictly necessary and security cookies cannot be disabled without impairing the platform's core functionality.

phmac does not use third-party advertising cookies or allow external ad networks to place tracking cookies on the phmac website for retargeting or behavioural advertising purposes.

8Data Retention

phmac retains personal data only for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable Philippine law. The following retention principles apply:

• Active account data: Personal data associated with an active phmac account is retained for the full duration that the account remains open and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and anti-money laundering obligations under Philippine law.
• KYC verification documents: Identity documents submitted during the KYC process are retained for a minimum of five years from the date of submission or account closure, whichever is later, as required by the Anti-Money Laundering Act.
• Financial transaction records: All deposit, withdrawal, and wagering transaction records are retained for a minimum of five years from the date of each transaction for audit, compliance, and dispute resolution purposes.
• Customer support communications: Email and chat records from customer support interactions are retained for a minimum of two years from the date of the interaction.
• Marketing data: Marketing preference and communication history data is retained until you withdraw your consent to marketing communications, after which it will be deleted within 30 days, subject to retention required for compliance purposes.
• Technical and log data: Server log data, IP address records, and session data are retained for up to 12 months for security, fraud prevention, and platform performance purposes.

Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised so that it can no longer be associated with any identifiable individual.

9Data Security Measures

phmac implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our data security framework includes:

• Transport Layer Security (TLS): All data transmitted between your device and the phmac platform is encrypted using TLS 1.2 or higher. You will see a padlock indicator in your browser confirming the encrypted connection.
• Encryption at rest: Sensitive personal data and financial records stored on phmac's servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within phmac's internal systems is granted on a strict need-to-know basis. All internal access is authenticated, logged, and audited. Privileged access to production systems is further restricted and monitored.
• Multi-factor authentication (MFA): phmac offers and encourages multi-factor authentication for player accounts to provide an additional layer of protection against unauthorised logins.
• Vulnerability management: phmac conducts regular security assessments, penetration testing, and vulnerability scans of its platform infrastructure to proactively identify and remediate security weaknesses.
• Incident response: phmac maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, phmac will notify the National Privacy Commission within 72 hours of discovery and will notify affected players without undue delay, as required by the Philippine Data Privacy Act.

10Your Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by phmac. You may exercise any of these rights by contacting phmac at [email protected].

• Right to be informed: You have the right to be informed whether phmac holds personal data about you, and to receive clear information about how that data is being used — which is the purpose of this Privacy Policy.
• Right of access: You have the right to request a copy of the personal data phmac holds about you and to receive information about the specific purposes for which it is processed.
• Right to rectification: You have the right to request correction of any inaccurate, incomplete, or outdated personal data phmac holds about you. You may update certain account details directly via your phmac account settings.
• Right to erasure: In certain circumstances, you have the right to request deletion of your personal data. This right is subject to limitations where phmac is required to retain data by law — for example, for AML compliance and PAGCOR record-keeping obligations.
• Right to data portability: You have the right to request a copy of the personal data you have provided to phmac in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where phmac relies on legitimate interests as its legal basis. You also have an absolute right to object to the use of your data for direct marketing purposes at any time.
• Right to lodge a complaint: If you believe phmac has handled your personal data in a manner that violates the Philippine Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

11Children & Minors

The phmac platform is intended exclusively for adults aged 21 years and above in compliance with Philippine gambling regulations and PAGCOR requirements. phmac does not knowingly collect personal data from any individual under the age of 21.

If you are a parent or guardian and you believe your child has accessed the phmac platform or submitted personal data to phmac, please contact us immediately at [email protected]. We will investigate the matter promptly and take all necessary steps to delete the minor's data and close any associated account.

phmac employs age verification checks during the account registration process and as part of the KYC verification procedure. Players are required to submit valid government-issued identification confirming their date of birth before real-money gaming features are activated on their account.

12Marketing Communications

phmac may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, special events, and other phmac offers — but only if you have expressly opted in to receive marketing communications during registration or through your account settings.

Every marketing communication sent by phmac will include a clear and easy method to unsubscribe or opt out. You may also withdraw your marketing consent at any time by:

• Clicking the "Unsubscribe" link included in any phmac marketing email;
• Updating your notification preferences in your phmac account settings; or
• Contacting phmac support directly at [email protected] and requesting removal from marketing lists.

Withdrawal of marketing consent will be processed within 5 business days. Please note that withdrawing consent to marketing communications will not affect your ability to receive transactional messages related to your account — such as deposit confirmations, withdrawal notifications, KYC status updates, and security alerts — as these are necessary for the operation of your phmac account and are sent on the basis of contractual necessity, not marketing consent.

13Changes to This Privacy Policy

phmac reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine laws and regulations, PAGCOR requirements, or the features and services offered on the phmac platform.

When we make material changes to this Privacy Policy, we will notify you through one or more of the following methods:

• A prominent notice displayed on the phmac website homepage or login page;
• An email notification sent to the address registered on your phmac account; or
• An in-platform notification visible when you next log in to your phmac account.

The updated Privacy Policy will indicate the new effective date at the top of the document. Your continued use of the phmac platform after the effective date of any updated policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should stop using the phmac platform and contact us to close your account.

We encourage you to review this Privacy Policy periodically so that you remain informed about how phmac is protecting your personal data. Minor or non-material changes — such as typographical corrections or clarifications that do not alter the substance of how your data is processed — may be made without specific notification.

14Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the way phmac processes your personal data, you are welcome to contact the phmac privacy team at any time. Our support team is available 24 hours a day, 7 days a week, and can assist in both English and Filipino.

You may reach us through the following channel:

• Email: [email protected]

When contacting us about a privacy matter, please include your registered phmac username and the email address associated with your account, along with a clear description of your request or concern. This will help our team locate your records and respond to you as efficiently as possible.

phmac is committed to resolving all privacy-related concerns fairly and promptly. We take every data rights request and privacy complaint seriously, and we will always provide a written response within the timeframes described in Section 10 of this policy.