phatay Privacy Policy

1.1 phatay takes the privacy of its users seriously. This Policy is designed to provide you with a clear and honest account of how we handle your personal data. We do not use complicated legal language to obscure what we do — we want every Filipino player on our platform to understand, in plain terms, exactly how their information is treated.

1.2 This Policy should be read together with phatay's Terms & Conditions and our Responsible Gaming Policy. Terms defined in the phatay Terms & Conditions carry the same meaning in this Policy unless otherwise stated.

1.3 If you are under 21 years of age, you must not use the phatay platform or submit any personal information to phatay. phatay does not knowingly collect personal data from individuals below the minimum age of 21.

1.4 phatay processes personal data in accordance with applicable Philippine laws governing data protection and privacy, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.

2.1 For the purposes of applicable data protection legislation, phatay is the data controller responsible for your personal information. As data controller, phatay determines the purposes and means by which your personal data is processed.

2.2 phatay operates within the Philippine regulatory framework and is subject to oversight by PAGCOR (Philippine Amusement and Gaming Corporation) with respect to the processing of player data in connection with gaming activities.

2.3 If you have any questions about data controllership or wish to exercise any rights with respect to your personal data, please contact phatay's Data Protection Officer through the contact details provided in Section 15 of this Policy.

3.1 phatay collects personal data that you provide directly, data generated through your use of the platform, and data received from third-party sources where lawfully permitted. The categories of personal data we collect include:

3.2 Where phatay is required to collect personal data by law or under the terms of a contract with you, and you fail to provide that data when requested, phatay may be unable to provide the relevant service — including processing withdrawals or maintaining your account.

4.1 Directly From You

The majority of personal data phatay holds about you is provided directly by you when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account settings. This includes information entered into forms on the phatay platform and documents submitted for identity verification.

4.2 Automatically Through Platform Use

When you use the phatay platform, certain technical data is collected automatically. This includes your IP address, device identifiers, browser type, pages visited, time spent on each page, referring URLs, and game session data. This information is collected using cookies, server logs, and similar tracking technologies as further described in Section 7.

4.3 From Third Parties

phatay may receive personal data about you from third-party sources in limited circumstances, including:

• Payment service providers (e.g., GCash, PayMaya, BPI, BDO, Metrobank) in connection with the processing of deposits and withdrawals;
• Identity verification and KYC service providers used to confirm your identity and age;
• Fraud detection and anti-money laundering screening services;
• Regulatory bodies such as PAGCOR, where required for compliance purposes.

5.1 phatay processes your personal data on one or more of the following legal bases:

• Contract performance: Processing necessary to perform the contract between you and phatay — including operating your account, processing transactions, and delivering gaming services;
• Legal obligation: Processing required to comply with applicable Philippine laws and regulations, including PAGCOR requirements, anti-money laundering obligations, and tax reporting requirements;
• Legitimate interests: Processing necessary for phatay's legitimate business interests, including fraud prevention, platform security, and improving our services, where these interests are not overridden by your privacy rights;
• Consent: Where phatay relies on your explicit consent as the legal basis for processing — for example, for certain direct marketing communications — you may withdraw that consent at any time without affecting the lawfulness of prior processing.

5.2 Specific Purposes

phatay processes your personal data for the following purposes:

• Creating and managing your phatay account;
• Verifying your identity and age in accordance with KYC and AML requirements;
• Processing deposits and withdrawals through your registered payment methods;
• Delivering gaming services, including calculating game outcomes and maintaining accurate records;
• Detecting, investigating, and preventing fraud, money laundering, and other illegal activity;
• Providing customer support and resolving disputes;
• Operating responsible gaming tools and monitoring for indicators of problem gambling;
• Complying with legal obligations and responding to lawful requests from regulatory authorities;
• Communicating with you about your account, promotions (where you have opted in), and platform updates;
• Analysing platform usage to improve phatay's services and user experience.

6.1 phatay does not sell, rent, or trade your personal data to third parties for their own marketing purposes. phatay may share your personal data with third parties only in the limited circumstances described below.

6.2 Service Providers

phatay works with carefully selected third-party service providers who perform functions on our behalf. These include payment processors (GCash, PayMaya, BPI, BDO, Metrobank), KYC and identity verification providers, fraud detection and AML screening services, customer support platform providers, cloud hosting and data storage providers, and analytics providers. All third-party service providers are required to process your personal data only for the purposes specified by phatay, in accordance with our instructions, and subject to appropriate data protection obligations.

6.3 Regulatory and Legal Disclosure

phatay may disclose your personal data to PAGCOR, the National Privacy Commission, law enforcement agencies, or other competent Philippine authorities where required by applicable law, regulation, court order, or lawful governmental request. phatay will use reasonable efforts to notify you of such disclosures where permitted to do so by law.

6.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of phatay's assets, your personal data may be transferred to the relevant successor entity. phatay will notify registered users of any such transfer and the applicable privacy terms of the successor entity.

7.1 phatay uses cookies and similar tracking technologies (such as web beacons and local storage) to operate and improve the platform. Cookies are small text files stored on your device that help phatay recognise you when you return to the platform, maintain your session, remember your preferences, and analyse how the platform is used.

7.2 Types of Cookies Used

• Essential Cookies: Required for the platform to function correctly. These include session cookies that keep you logged into your phatay account and security cookies that help protect against unauthorised access. These cookies cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings and game lobby layout. These improve your experience on phatay but are not strictly necessary.
• Analytics Cookies: Collect aggregated, anonymised data about how users interact with phatay — such as which pages are visited most frequently and where users encounter errors. This information helps phatay improve its platform.
• Security Cookies: Help phatay detect and prevent fraudulent activity, including unusual login patterns or suspicious transaction behaviour.

7.3 You can manage cookie preferences through your browser settings. Please note that disabling essential cookies may affect the functionality of the phatay platform and your ability to access certain features, including logging in to your account.

8.1 phatay retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, and reporting obligations.

8.2 As a general guide, phatay's retention periods are as follows:

• Account and identity data: Retained for the duration of your active phatay account and for a minimum of five (5) years following account closure, in accordance with Philippine AML obligations;
• Financial and transaction data: Retained for a minimum of five (5) years from the date of the transaction, in accordance with applicable financial regulations;
• Gaming records: Retained for a minimum of three (3) years, or longer where required by PAGCOR or other applicable regulatory requirements;
• Customer support records: Retained for three (3) years following the resolution of the relevant matter;
• Technical and analytical data: Typically retained in identifiable form for up to twelve (12) months, after which it may be anonymised and retained for longer periods for statistical analysis.

8.3 Where phatay no longer has a legitimate purpose or legal obligation to retain your personal data, it will be securely deleted or anonymised in a manner that prevents re-identification.

9.1 Under the Philippine Data Privacy Act of 2012 and applicable regulations, you have the following rights with respect to your personal data held by phatay:

9.2 To exercise any of these rights, please contact phatay's Data Protection Officer using the details in Section 15. phatay will respond to your request within 30 calendar days of receipt. Where a request is complex or numerous, phatay may extend this period by up to a further 30 days, in which case you will be notified of the extension and the reasons for it.

9.3 Please note that some rights are subject to limitations. For example, phatay may be required to retain certain data to comply with legal obligations notwithstanding a request for erasure. Where phatay is unable to fully comply with a request, we will explain the reason.

10.1 phatay implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and phatay's servers;
• Encryption of sensitive data at rest, including financial and identity records;
• Multi-factor authentication requirements for account access and high-value transactions;
• Strict role-based access controls limiting internal access to personal data on a need-to-know basis;
• Regular security audits, penetration testing, and vulnerability assessments;
• Incident response procedures for the detection, reporting, and remediation of data security events;
• Staff training on data protection obligations and information security practices.

10.2 While phatay takes every reasonable precaution to secure your personal data, no method of electronic transmission or storage is entirely without risk. phatay cannot guarantee absolute security, and you should ensure that you protect your own account credentials and notify phatay immediately if you suspect any unauthorised access to your phatay account.

10.3 In the event of a personal data breach that poses a risk to your rights and freedoms, phatay will notify the National Privacy Commission and affected users in accordance with the requirements of the Data Privacy Act of 2012 and its implementing rules.

11.1 The phatay platform integrates with third-party services — including payment processors, gaming content providers, and analytics tools — as part of its operation. These third parties may have access to certain technical or transactional data as necessary to perform their functions.

11.2 All third parties with whom phatay shares personal data are required to maintain appropriate data protection standards and to process your data only in accordance with phatay's instructions and for the specific purposes described in this Policy.

11.3 phatay is not responsible for the privacy practices of any third-party services that operate independently of phatay's platform. This Policy applies solely to data processed by phatay in connection with your use of phatay.co.

12.1 If phatay discovers or has reason to believe that it has collected personal data from an individual below the age of 21, it will take immediate steps to delete that data and close the associated account. Any deposits or wagers placed by an underage user will be handled in accordance with phatay's Terms & Conditions and applicable regulatory requirements.

12.2 If you believe that a minor has registered an account on phatay or submitted personal data to phatay, please contact our support team immediately via live chat or email so that we can investigate and take appropriate action.

13.1 In certain circumstances, phatay may transfer your personal data to third-party service providers located outside the Philippines — for example, where phatay uses international cloud hosting providers or gaming platform vendors with servers based in other jurisdictions.

13.2 Where such transfers occur, phatay takes appropriate steps to ensure that your personal data continues to receive a level of protection consistent with the Data Privacy Act of 2012 and this Policy. These steps include entering into data processing agreements with recipient organisations that include appropriate data protection provisions, and assessing the data protection laws of recipient jurisdictions before any transfer is made.

13.3 By using the phatay platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside the Philippines, subject to the safeguards described in this section.

14.1 phatay reserves the right to update or amend this Privacy Policy at any time. The effective date of the most recent revision is stated at the top of this document. Where amendments are material, phatay will make reasonable efforts to notify registered users via their registered email address or through a prominent notice on the phatay platform prior to the changes taking effect.

14.2 Your continued use of the phatay platform after a revised Privacy Policy takes effect constitutes your acknowledgement of the updated Policy. If you do not agree to any changes, you should cease using the platform and close your account.

14.3 Prior versions of this Privacy Policy are available upon request from phatay's Data Protection Officer.

15.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data by phatay, please contact us through any of the following channels:

• Live Chat: Available 24/7 on the phatay platform — average response under 2 minutes.
• Email: [email protected] — for privacy-related enquiries, please mark your subject line "Privacy Request — [Your Name]".

15.2 For formal data subject access requests or complaints under the Data Privacy Act of 2012, please mark your correspondence as "Data Privacy Act Request — Formal." phatay will acknowledge receipt within five (5) business days and provide a substantive response within thirty (30) calendar days.

15.3 You also have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe that phatay has violated your data privacy rights. phatay encourages you to contact us first to resolve any concern directly before escalating to the NPC.