Privacy Policy

1. Overview & Scope

This Privacy Policy ("Policy") sets out how ph30 ("ph30," "we," "us," "our") collects, uses, stores, shares, and protects the personal information of individuals ("you," "Member," "User," "Player") who access or use the ph30 online gaming platform, website at ph30.pro, mobile interface, customer support channels, and any other ph30 services.

This Policy applies to all personal data processed by ph30 in connection with your use of its platform — whether you are a registered member, a visitor browsing the ph30 website, or a person who contacts ph30 via email, live chat, or any other support channel. It applies regardless of the device or medium through which you access ph30's services.

This Policy should be read alongside ph30's Terms & Conditions and Responsible Gaming policy, both of which form part of the broader framework governing your relationship with ph30. By accessing ph30's platform or registering an account, you acknowledge that you have read and understood this Policy.

2. Data Controller

ph30 is the data controller responsible for the personal information collected and processed in connection with the ph30 platform. As data controller, ph30 determines the purposes and means of processing your personal data and is accountable for ensuring that such processing is conducted in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

ph30 has designated a Data Protection Officer (DPO) who is responsible for overseeing data protection compliance, responding to data subject rights requests, and serving as the primary point of contact for data privacy matters. Contact details for ph30's DPO are provided in Section 14 of this Policy.

ph30 is registered as a personal information controller with the National Privacy Commission (NPC) of the Philippines, in accordance with the requirements of RA 10173 and the NPC's registration framework for entities processing sensitive personal information.

3. Data We Collect

ph30 collects personal information that is necessary and proportionate to the purposes for which it is processed. The categories of personal data we collect are set out below.

3.1 Registration & Account Data

When you create a ph30 account, we collect the following information:

• Full legal name as it appears on your government-issued identification document
• Date of birth (for age verification — you must be 21 years or older)
• Philippine mobile number
• Email address
• Residential address in the Philippines
• Username and encrypted account password
• Security questions and answers (where applicable)

3.2 Identity Verification (KYC) Data

To comply with PAGCOR regulations and anti-money laundering obligations, ph30 collects:

• Government-issued photo identification (e.g., PhilSys National ID, Passport, LTO Driver's License, UMID, SSS ID, GSIS ID, or PRC ID)
• Proof of address documents (e.g., utility bill or bank statement issued within the last 90 days)
• Selfie or facial photograph for identity matching purposes
• Proof of source of funds for transactions meeting AML reporting thresholds

3.3 Financial Transaction Data

When you make deposits or withdrawals, ph30 processes the following financial information:

• GCash or Maya wallet number (masked, not stored in full)
• Bank account details for BPI, BDO, Metrobank, or UnionBank transfers (account name and masked account number)
• Transaction reference numbers and amounts
• Payment method used and transaction timestamps

3.4 Gaming & Betting Activity Data

• Game history, bet amounts, wager results, and session durations
• Bonus claims, wagering progress, and promotion participation history
• Sports betting selections and outcomes
• Responsible gaming tool settings (deposit limits, self-exclusion status, cool-off periods)

3.5 Technical & Device Data

• IP address and approximate geolocation (to verify Philippine jurisdiction)
• Device type, operating system, and browser information
• Session timestamps, login history, and platform navigation data
• Cookie identifiers and similar tracking technologies (see Section 9)

3.6 Communications Data

• Records of live chat, email, and other support communications with ph30
• Survey responses and feedback submitted to ph30
• Marketing preferences and consent records

4. How We Use Your Data

ph30 uses the personal information we collect for the following specific purposes. We process personal data only to the extent necessary for each stated purpose and do not use personal data in ways that are incompatible with the purpose for which it was originally collected.

5. Legal Basis for Processing

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, ph30 processes your personal data on the following lawful bases:

• Contract Performance: Processing is necessary to perform the contract between you and ph30 — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing is required to comply with Philippine law, including PAGCOR's licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act itself.
• Legitimate Interest: ph30 processes certain data based on its legitimate interest in maintaining platform security, preventing fraud, and improving service quality — provided such interests are not overridden by your rights and interests as a data subject.
• Consent: For optional processing activities such as marketing communications and certain cookie placements, ph30 relies on your freely given, informed, and specific consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing & Third-Party Disclosure

ph30 does not sell, rent, or trade your personal information to third parties for their own commercial purposes. We share your personal data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

6.1 Regulatory and Legal Authorities

ph30 is required to share personal data with PAGCOR as its licensing regulator, the Anti-Money Laundering Council (AMLC) in relation to suspicious transaction reporting, and other Philippine government agencies where required by law, court order, or valid legal process.

6.2 Payment Service Providers

To process deposits and withdrawals, ph30 shares necessary transaction data with payment partners including GCash, Maya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, and other payment processors. These partners receive only the minimum data required to process the specific transaction and are contractually bound to use your data solely for that purpose.

6.3 Identity Verification and KYC Providers

ph30 uses accredited third-party KYC and identity verification service providers to assist in verifying the authenticity of identification documents and conducting facial matching. These providers are bound by strict data processing agreements and may not use your data for any purpose other than providing verification services to ph30.

6.4 Technology and Hosting Providers

ph30's platform infrastructure is supported by technology partners including cloud hosting providers, game software suppliers, and IT security service providers. These entities process personal data solely as data processors acting on ph30's documented instructions and are required to maintain security standards at least equivalent to those applied by ph30.

6.5 Professional Advisers

ph30 may share personal data with its legal advisers, auditors, and accountants where necessary for the conduct of their professional services, subject to applicable professional confidentiality obligations.

7. Data Retention

ph30 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR's record-keeping requirements. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five years from the date of account closure, in accordance with PAGCOR and AMLC record-keeping requirements.
• Financial transaction records: Retained for a minimum of five years from the date of the transaction, as required by the Anti-Money Laundering Act.
• Gaming activity data: Retained for a minimum of three years from the date of activity, or longer where required for dispute resolution, regulatory audit, or legal proceedings.
• Customer support communications: Retained for two years from the date of the last communication in any support case, or longer where the communication is relevant to an ongoing dispute or investigation.
• Marketing consent records: Retained until you withdraw consent and for a period of three years thereafter as proof of your consent history.
• Technical and device data (logs): Retained for 12 months in standard server logs, extended where needed for security incident investigation.

When retention periods expire, personal data is securely deleted or anonymised in a manner that prevents re-identification. ph30 conducts periodic data audits to ensure that data is not retained beyond applicable retention periods.

8. Security Measures

ph30 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit: All data transmitted between your device and ph30's platform is encrypted using TLS 1.2 or higher with 256-bit SSL certificates.
• Encryption at rest: Sensitive personal data stored in ph30's databases, including KYC documents and financial information, is encrypted using industry-standard AES-256 encryption.
• Access controls: Access to personal data is restricted to ph30 staff who have a legitimate need to access it as part of their role. Role-based access controls and multi-factor authentication are applied to all internal systems containing personal data.
• Password security: Account passwords are stored as one-way salted hashes and are never stored or transmitted in plain text.
• Penetration testing: ph30's platform undergoes regular security penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Incident response: ph30 maintains a documented data breach response procedure and will notify the National Privacy Commission (NPC) and affected data subjects within the timeframes prescribed by RA 10173 in the event of a notifiable personal data breach.

While ph30 takes all reasonable steps to protect your personal data, no internet-based system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for ensuring that your own device security is adequate.

9. Cookies & Tracking Technologies

ph30 uses cookies and similar tracking technologies on its platform to provide core functionality, improve the user experience, and analyse platform usage. A cookie is a small text file placed on your device by the ph30 website when you visit it. ph30 uses the following categories of cookies:

You can manage your cookie preferences through the cookie consent banner displayed on your first visit to ph30.pro, or by adjusting your browser settings to block or delete cookies. Note that disabling strictly necessary cookies will impair your ability to use the platform. ph30 does not use third-party advertising network cookies or share cookie data with external advertising platforms.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ph30. You may exercise these rights by contacting ph30's Data Protection Officer using the contact details provided in Section 14.

ph30 will respond to data subject rights requests within 15 business days of receipt. Where a request is complex or involves a large volume of data, ph30 may extend this period by a further 15 business days with prior written notice. ph30 may need to verify your identity before processing a rights request to ensure that personal data is not disclosed to an unauthorised person.

11. Minors & Age Policy

ph30's gaming services are strictly restricted to individuals aged 21 years and above, as mandated by PAGCOR. ph30 does not knowingly collect personal data from anyone under the age of 21. All accounts are subject to mandatory age verification as part of the KYC process, and any account found to belong to a person under 21 will be immediately suspended and all associated personal data will be securely deleted, except where retention is required by law.

If you are a parent or guardian and you believe that a minor in your care has registered an account with ph30 or has provided personal data to ph30, please contact ph30's Data Protection Officer immediately. ph30 will investigate and take prompt action to secure and, where appropriate, delete the minor's personal data.

ph30 does not direct any marketing or communications towards minors and does not intentionally collect or process personal data relating to children under the age of 21 for any purpose.

12. Cross-Border Data Transfers

ph30's primary data processing operations are based in the Philippines. In limited circumstances, personal data may be transferred to or accessed by ph30's technology partners or service providers operating in other jurisdictions — for example, cloud infrastructure providers or game software suppliers whose servers are located outside the Philippines.

Where such transfers occur, ph30 ensures that adequate safeguards are in place in accordance with Section 21 of RA 10173 and NPC Circular No. 16-01. These safeguards may include:

• Standard contractual clauses approved by the NPC or equivalent regulatory authority
• Binding corporate rules where the recipient is part of a corporate group
• The recipient country providing a level of data protection substantially equivalent to that provided by Philippine law
• Your explicit consent to the transfer, where required

ph30 will not transfer your personal data to any jurisdiction that the NPC has identified as lacking adequate data protection standards without putting appropriate protective measures in place and, where required, obtaining your consent.

13. Changes to This Privacy Policy

ph30 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in applicable law, PAGCOR's regulatory requirements, ph30's data processing practices, or developments in data protection best practice. The current version of this Policy is identified by the "Last updated" date shown at the top of this page.

When material changes are made to this Policy — that is, changes that significantly affect your rights or how ph30 processes your personal data — ph30 will notify registered members by email to the address on file and/or by displaying a prominent notice on the platform for a minimum of 14 days before the changes take effect.

Your continued use of ph30's platform after the effective date of any revised Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with any changes to this Policy, you should cease using ph30's services and may request account closure in accordance with the Terms & Conditions.

14. Contact & Data Protection Officer

If you have any questions, concerns, or requests in relation to this Privacy Policy or ph30's data processing practices, you may contact ph30's Data Protection Officer through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly on the ph30 platform after logging in. Select "Privacy & Data" from the support menu.

ph30's DPO will acknowledge receipt of your request within three business days and provide a substantive response within 15 business days, extended where necessary as described in Section 10.

If you are not satisfied with ph30's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the independent regulatory authority responsible for enforcing RA 10173. Information about how to file an NPC complaint is available through PAGCOR's official regulatory channels or the NPC's own public communications.